Analysis

  • max time kernel
    197s
  • max time network
    195s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01-10-2024 15:04

General

  • Target

    CucumberPerm.exe

  • Size

    4.4MB

  • MD5

    fdc104e5c49f8dbecfd3cdae4cd1786b

  • SHA1

    79e8c33151a53746865e13f4b12c4b6e7899c559

  • SHA256

    ee86642427c5a1b6f949f6e3161da1b8bb05594d4730f815ebc34478a79e76fd

  • SHA512

    b422308220a1adc81a7c0b082f9967e48f200b9de072ca56435d4ebb872709dcab00b1070e7c8cc5d927d24f760cf9eedae801f1a5ea13777d4807b7d2f326e2

  • SSDEEP

    98304:6hPPkkqr3RwUo8UTEF0pflxoLQVHIk9jh1zlgu/ymvOpUypuJK7Cjgzn:6hPPWBwT8kFl9th1z6uxODpRCEL

Malware Config

Signatures

  • Cerber 64 IoCs

    Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Stops running service(s) 4 TTPs
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Themida packer 8 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 21 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 18 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 21 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Enumerates system info in registry 2 TTPs 27 IoCs
  • Gathers network information 2 TTPs 3 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 21 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CucumberPerm.exe
    "C:\Users\Admin\AppData\Local\Temp\CucumberPerm.exe"
    1⤵
      PID:5064
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4824
      • C:\Users\Admin\Desktop\CucumberPerm.exe
        "C:\Users\Admin\Desktop\CucumberPerm.exe"
        1⤵
          PID:4948
        • C:\Users\Admin\Desktop\CucumberPerm.exe
          "C:\Users\Admin\Desktop\CucumberPerm.exe"
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:2536
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\C7F0.tmp\C7F1.bat C:\Users\Admin\Desktop\CucumberPerm.exe"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4520
            • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\Cucumber-Permanently-Spoofer.exe
              Cucumber-Permanently-Spoofer.exe
              3⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4756
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c mode con: cols=50 lines=20
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:4352
                • C:\Windows\system32\mode.com
                  mode con: cols=50 lines=20
                  5⤵
                    PID:1228
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c title %computername%
                  4⤵
                    PID:624
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c cls
                    4⤵
                      PID:3380
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c taskkill /F /IM EpicGamesLauncher.exe >nul 2>&1
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4552
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /IM EpicGamesLauncher.exe
                        5⤵
                        • Cerber
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4384
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheatLauncher.exe >nul 2>&1
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3836
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /IM EasyAntiCheatLauncher.exe
                        5⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:664
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c taskkill /F /IM BEService.exe >nul 2>&1
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1892
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /IM BEService.exe
                        5⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1224
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c taskkill /F /IM Fortnite.exe >nul 2>&1
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1508
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /IM Fortnite.exe
                        5⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2076
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c taskkill /F /IM BattleEyeLauncher.exe >nul 2>&1
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5060
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /IM BattleEyeLauncher.exe
                        5⤵
                        • Cerber
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3088
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping.exe >nul 2>&1
                      4⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:1492
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /IM FortniteClient-Win64-Shipping.exe
                        5⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4496
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c sc stop BEService >nul 2>&1
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4392
                      • C:\Windows\system32\sc.exe
                        sc stop BEService
                        5⤵
                        • Launches sc.exe
                        PID:4612
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c sc stop BEDaisy >nul 2>&1
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4748
                      • C:\Windows\system32\sc.exe
                        sc stop BEDaisy
                        5⤵
                        • Launches sc.exe
                        PID:2212
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c sc stop EasyAntiCheat >nul 2>&1
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4168
                      • C:\Windows\system32\sc.exe
                        sc stop EasyAntiCheat
                        5⤵
                        • Launches sc.exe
                        PID:2580
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c sc stop EasyAntiCheatSys >nul 2>&1
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2940
                      • C:\Windows\system32\sc.exe
                        sc stop EasyAntiCheatSys
                        5⤵
                        • Launches sc.exe
                        PID:2064
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c cls
                      4⤵
                        PID:2664
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c Disk1.exe
                        4⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4664
                        • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\Disk1.exe
                          Disk1.exe
                          5⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:4516
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c Disk2.exe
                        4⤵
                          PID:628
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\Disk2.exe
                            Disk2.exe
                            5⤵
                            • Executes dropped EXE
                            PID:2204
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c Spoof.bat
                          4⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2640
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /IVN 24953-6777-28228
                            5⤵
                            • Cerber
                            • Executes dropped EXE
                            PID:4780
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /IV 13171-11107-4490
                            5⤵
                            • Executes dropped EXE
                            PID:3664
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /IV 18405-12879-13006
                            5⤵
                            • Cerber
                            • Executes dropped EXE
                            PID:4728
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /SM 31118-30276-20534
                            5⤵
                            • Cerber
                            • Executes dropped EXE
                            PID:4200
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /SP 18771-9103-29903
                            5⤵
                            • Cerber
                            • Executes dropped EXE
                            PID:3160
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /SV 3878-19465-3863
                            5⤵
                            • Executes dropped EXE
                            PID:224
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /SS 16507-17815-3995
                            5⤵
                            • Executes dropped EXE
                            PID:4404
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /SU AUTO
                            5⤵
                            • Cerber
                            • Executes dropped EXE
                            PID:2052
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /SK 30195-17520-10332
                            5⤵
                            • Executes dropped EXE
                            PID:4724
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /SF 21150-17719-32514
                            5⤵
                            • Cerber
                            • Executes dropped EXE
                            PID:4440
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /BM 11211-10785-10114
                            5⤵
                            • Executes dropped EXE
                            PID:2652
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /BP 29412-29-7301
                            5⤵
                            • Cerber
                            • Executes dropped EXE
                            PID:4824
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /BV 1155-14488-11544
                            5⤵
                            • Cerber
                            • Executes dropped EXE
                            PID:4408
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /BS 24207-6588-17450
                            5⤵
                            • Cerber
                            • Executes dropped EXE
                            PID:2596
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /BT 4331-26299-4230
                            5⤵
                            • Cerber
                            • Executes dropped EXE
                            PID:2144
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /BLC 13086-18009-19155
                            5⤵
                            • Executes dropped EXE
                            PID:3416
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /CM 13654-13991-13849
                            5⤵
                            • Cerber
                            • Executes dropped EXE
                            PID:1040
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /CV 7105-13374-28186
                            5⤵
                            • Executes dropped EXE
                            PID:4940
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /CS 22397-13218-32439
                            5⤵
                            • Executes dropped EXE
                            PID:3204
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /CA 17825-25683-10779
                            5⤵
                            • Cerber
                            • Executes dropped EXE
                            PID:2556
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /CSK 16029-11572-1033
                            5⤵
                            • Cerber
                            • Executes dropped EXE
                            PID:2476
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /PSN 25328-31355-15301
                            5⤵
                            • Cerber
                            • Executes dropped EXE
                            PID:992
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /PAT 12820-27346-20233
                            5⤵
                            • Executes dropped EXE
                            PID:4880
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /PPN 4795-25489-5753
                            5⤵
                            • Cerber
                            • Executes dropped EXE
                            PID:4752
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /OS 1 25075-5538-12333
                            5⤵
                            • Cerber
                            • Executes dropped EXE
                            PID:4640
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /OS 2 6131-29148-18977
                            5⤵
                            • Executes dropped EXE
                            PID:3484
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /OS 3 579-32316-10147
                            5⤵
                            • Executes dropped EXE
                            PID:4972
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /OS 4 29740-4677-21262
                            5⤵
                            • Cerber
                            • Executes dropped EXE
                            PID:1128
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /OS 5 3301-17018-12637
                            5⤵
                            • Cerber
                            • Executes dropped EXE
                            PID:2716
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /OS 6 19194-19395-7994
                            5⤵
                            • Cerber
                            • Executes dropped EXE
                            PID:4472
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /OS 7 10068-15288-7141
                            5⤵
                            • Executes dropped EXE
                            PID:1260
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /OS 8 30978-10162-19644
                            5⤵
                            • Cerber
                            • Executes dropped EXE
                            PID:2440
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /OS 9 190-6152-8743
                            5⤵
                            • Cerber
                            • Executes dropped EXE
                            PID:4120
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /OS 10 5641-15634-21396
                            5⤵
                            • Cerber
                            • Executes dropped EXE
                            PID:4352
                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                            inertia.exe /OS 11 29225-8522-8118
                            5⤵
                            • Cerber
                            • Executes dropped EXE
                            PID:64
                          • C:\Windows\system32\net.exe
                            net stop winmgmt /Y
                            5⤵
                              PID:2316
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 stop winmgmt /Y
                                6⤵
                                  PID:3188
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c net stop winmgmt /y
                              4⤵
                                PID:3932
                                • C:\Windows\system32\net.exe
                                  net stop winmgmt /y
                                  5⤵
                                    PID:2804
                                    • C:\Windows\system32\net1.exe
                                      C:\Windows\system32\net1 stop winmgmt /y
                                      6⤵
                                        PID:1800
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c net start winmgmt /y
                                    4⤵
                                      PID:1120
                                      • C:\Windows\system32\net.exe
                                        net start winmgmt /y
                                        5⤵
                                          PID:4592
                                          • C:\Windows\system32\net1.exe
                                            C:\Windows\system32\net1 start winmgmt /y
                                            6⤵
                                              PID:1444
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c sc stop winmgmt
                                          4⤵
                                            PID:3436
                                            • C:\Windows\system32\sc.exe
                                              sc stop winmgmt
                                              5⤵
                                              • Launches sc.exe
                                              PID:3712
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c sc start winmgmt
                                            4⤵
                                              PID:3384
                                              • C:\Windows\system32\sc.exe
                                                sc start winmgmt
                                                5⤵
                                                • Launches sc.exe
                                                PID:4596
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c mode con: cols=50 lines=20
                                              4⤵
                                                PID:4260
                                                • C:\Windows\system32\mode.com
                                                  mode con: cols=50 lines=20
                                                  5⤵
                                                    PID:4412
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c title %computername%
                                                  4⤵
                                                    PID:872
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c cls
                                                    4⤵
                                                      PID:4744
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c taskkill /F /IM EpicGamesLauncher.exe >nul 2>&1
                                                      4⤵
                                                        PID:4920
                                                        • C:\Windows\system32\taskkill.exe
                                                          taskkill /F /IM EpicGamesLauncher.exe
                                                          5⤵
                                                          • Kills process with taskkill
                                                          PID:3084
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheatLauncher.exe >nul 2>&1
                                                        4⤵
                                                          PID:3672
                                                          • C:\Windows\system32\taskkill.exe
                                                            taskkill /F /IM EasyAntiCheatLauncher.exe
                                                            5⤵
                                                            • Kills process with taskkill
                                                            PID:3252
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c taskkill /F /IM BEService.exe >nul 2>&1
                                                          4⤵
                                                            PID:3356
                                                            • C:\Windows\system32\taskkill.exe
                                                              taskkill /F /IM BEService.exe
                                                              5⤵
                                                              • Kills process with taskkill
                                                              PID:5072
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c taskkill /F /IM Fortnite.exe >nul 2>&1
                                                            4⤵
                                                              PID:1900
                                                              • C:\Windows\system32\taskkill.exe
                                                                taskkill /F /IM Fortnite.exe
                                                                5⤵
                                                                • Kills process with taskkill
                                                                PID:4484
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c taskkill /F /IM BattleEyeLauncher.exe >nul 2>&1
                                                              4⤵
                                                                PID:4520
                                                                • C:\Windows\system32\taskkill.exe
                                                                  taskkill /F /IM BattleEyeLauncher.exe
                                                                  5⤵
                                                                  • Kills process with taskkill
                                                                  PID:2816
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping.exe >nul 2>&1
                                                                4⤵
                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                PID:4808
                                                                • C:\Windows\system32\taskkill.exe
                                                                  taskkill /F /IM FortniteClient-Win64-Shipping.exe
                                                                  5⤵
                                                                  • Kills process with taskkill
                                                                  PID:5092
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c sc stop BEService >nul 2>&1
                                                                4⤵
                                                                  PID:624
                                                                  • C:\Windows\system32\sc.exe
                                                                    sc stop BEService
                                                                    5⤵
                                                                    • Launches sc.exe
                                                                    PID:64
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c sc stop BEDaisy >nul 2>&1
                                                                  4⤵
                                                                    PID:4384
                                                                    • C:\Windows\system32\sc.exe
                                                                      sc stop BEDaisy
                                                                      5⤵
                                                                      • Launches sc.exe
                                                                      PID:5016
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c sc stop EasyAntiCheat >nul 2>&1
                                                                    4⤵
                                                                      PID:2756
                                                                      • C:\Windows\system32\sc.exe
                                                                        sc stop EasyAntiCheat
                                                                        5⤵
                                                                        • Launches sc.exe
                                                                        PID:1400
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c sc stop EasyAntiCheatSys >nul 2>&1
                                                                      4⤵
                                                                        PID:2648
                                                                        • C:\Windows\system32\sc.exe
                                                                          sc stop EasyAntiCheatSys
                                                                          5⤵
                                                                          • Launches sc.exe
                                                                          PID:2936
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c cls
                                                                        4⤵
                                                                          PID:3228
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c Disk1.exe
                                                                          4⤵
                                                                            PID:3564
                                                                            • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\Disk1.exe
                                                                              Disk1.exe
                                                                              5⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:4984
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c Disk2.exe
                                                                            4⤵
                                                                              PID:4348
                                                                              • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\Disk2.exe
                                                                                Disk2.exe
                                                                                5⤵
                                                                                  PID:2640
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c Spoof.bat
                                                                                4⤵
                                                                                  PID:5084
                                                                                  • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                    inertia.exe /IVN 6363-6368-5669
                                                                                    5⤵
                                                                                      PID:3836
                                                                                    • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                      inertia.exe /IV 8261-20043-10366
                                                                                      5⤵
                                                                                      • Cerber
                                                                                      PID:664
                                                                                    • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                      inertia.exe /IV 20677-18493-4635
                                                                                      5⤵
                                                                                      • Cerber
                                                                                      PID:1892
                                                                                    • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                      inertia.exe /SM 24610-32214-11604
                                                                                      5⤵
                                                                                      • Cerber
                                                                                      PID:4592
                                                                                    • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                      inertia.exe /SP 25914-2518-6347
                                                                                      5⤵
                                                                                        PID:1456
                                                                                      • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                        inertia.exe /SV 4222-10975-18879
                                                                                        5⤵
                                                                                        • Cerber
                                                                                        PID:2224
                                                                                      • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                        inertia.exe /SS 3016-28577-29797
                                                                                        5⤵
                                                                                          PID:4528
                                                                                        • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                          inertia.exe /SU AUTO
                                                                                          5⤵
                                                                                            PID:5060
                                                                                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                            inertia.exe /SK 2719-31250-30271
                                                                                            5⤵
                                                                                            • Cerber
                                                                                            PID:3436
                                                                                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                            inertia.exe /SF 16216-5023-3781
                                                                                            5⤵
                                                                                            • Cerber
                                                                                            PID:4488
                                                                                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                            inertia.exe /BM 24917-22992-11084
                                                                                            5⤵
                                                                                              PID:4376
                                                                                            • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                              inertia.exe /BP 9157-23171-24829
                                                                                              5⤵
                                                                                                PID:4124
                                                                                              • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                                inertia.exe /BV 27615-21750-3692
                                                                                                5⤵
                                                                                                  PID:4416
                                                                                                • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                                  inertia.exe /BS 3588-11457-21424
                                                                                                  5⤵
                                                                                                    PID:4748
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                                    inertia.exe /BT 608-17673-9550
                                                                                                    5⤵
                                                                                                      PID:4744
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                                      inertia.exe /BLC 3693-27961-6797
                                                                                                      5⤵
                                                                                                      • Cerber
                                                                                                      PID:4356
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                                      inertia.exe /CM 11482-197-6018
                                                                                                      5⤵
                                                                                                      • Cerber
                                                                                                      PID:2332
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                                      inertia.exe /CV 17147-15345-16285
                                                                                                      5⤵
                                                                                                        PID:3740
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                                        inertia.exe /CS 1759-8317-4835
                                                                                                        5⤵
                                                                                                        • Cerber
                                                                                                        PID:3748
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                                        inertia.exe /CA 5531-30888-25364
                                                                                                        5⤵
                                                                                                        • Cerber
                                                                                                        PID:4380
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                                        inertia.exe /CSK 10624-17373-28632
                                                                                                        5⤵
                                                                                                        • Cerber
                                                                                                        PID:3984
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                                        inertia.exe /PSN 28392-19489-15082
                                                                                                        5⤵
                                                                                                          PID:2236
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                                          inertia.exe /PAT 23078-31965-2536
                                                                                                          5⤵
                                                                                                            PID:2192
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                                            inertia.exe /PPN 24552-4209-10598
                                                                                                            5⤵
                                                                                                            • Cerber
                                                                                                            PID:3116
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                                            inertia.exe /OS 1 22600-12816-13921
                                                                                                            5⤵
                                                                                                            • Cerber
                                                                                                            PID:1472
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                                            inertia.exe /OS 2 26014-4039-25696
                                                                                                            5⤵
                                                                                                            • Cerber
                                                                                                            PID:2064
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                                            inertia.exe /OS 3 15692-32405-9730
                                                                                                            5⤵
                                                                                                              PID:4712
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                                              inertia.exe /OS 4 16271-3670-12007
                                                                                                              5⤵
                                                                                                                PID:3664
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                                                inertia.exe /OS 5 18674-24646-8157
                                                                                                                5⤵
                                                                                                                • Cerber
                                                                                                                PID:1016
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                                                inertia.exe /OS 6 28308-16239-9613
                                                                                                                5⤵
                                                                                                                • Cerber
                                                                                                                PID:4200
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                                                inertia.exe /OS 7 31252-29963-13042
                                                                                                                5⤵
                                                                                                                • Cerber
                                                                                                                PID:360
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                                                inertia.exe /OS 8 25476-28397-8584
                                                                                                                5⤵
                                                                                                                  PID:1304
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                                                  inertia.exe /OS 9 18079-11859-2365
                                                                                                                  5⤵
                                                                                                                  • Cerber
                                                                                                                  PID:4764
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                                                  inertia.exe /OS 10 15776-8067-20835
                                                                                                                  5⤵
                                                                                                                  • Cerber
                                                                                                                  PID:4824
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe
                                                                                                                  inertia.exe /OS 11 30491-19995-16922
                                                                                                                  5⤵
                                                                                                                  • Cerber
                                                                                                                  PID:5076
                                                                                                                • C:\Windows\system32\net.exe
                                                                                                                  net stop winmgmt /Y
                                                                                                                  5⤵
                                                                                                                    PID:4204
                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                      C:\Windows\system32\net1 stop winmgmt /Y
                                                                                                                      6⤵
                                                                                                                        PID:4420
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c net stop winmgmt /y
                                                                                                                    4⤵
                                                                                                                      PID:3416
                                                                                                                      • C:\Windows\system32\net.exe
                                                                                                                        net stop winmgmt /y
                                                                                                                        5⤵
                                                                                                                          PID:1720
                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                            C:\Windows\system32\net1 stop winmgmt /y
                                                                                                                            6⤵
                                                                                                                              PID:4948
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c net start winmgmt /y
                                                                                                                          4⤵
                                                                                                                            PID:1872
                                                                                                                            • C:\Windows\system32\net.exe
                                                                                                                              net start winmgmt /y
                                                                                                                              5⤵
                                                                                                                                PID:1340
                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                  C:\Windows\system32\net1 start winmgmt /y
                                                                                                                                  6⤵
                                                                                                                                    PID:4584
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c sc stop winmgmt
                                                                                                                                4⤵
                                                                                                                                  PID:2912
                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                    sc stop winmgmt
                                                                                                                                    5⤵
                                                                                                                                    • Launches sc.exe
                                                                                                                                    PID:2764
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c sc start winmgmt
                                                                                                                                  4⤵
                                                                                                                                    PID:1684
                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                      sc start winmgmt
                                                                                                                                      5⤵
                                                                                                                                      • Launches sc.exe
                                                                                                                                      PID:3000
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c mode con: cols=50 lines=20
                                                                                                                                    4⤵
                                                                                                                                      PID:4776
                                                                                                                                      • C:\Windows\system32\mode.com
                                                                                                                                        mode con: cols=50 lines=20
                                                                                                                                        5⤵
                                                                                                                                          PID:68
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c title %computername%
                                                                                                                                        4⤵
                                                                                                                                          PID:2696
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c cls
                                                                                                                                          4⤵
                                                                                                                                            PID:2936
                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -s Winmgmt
                                                                                                                                      1⤵
                                                                                                                                        PID:2076
                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -s Winmgmt
                                                                                                                                        1⤵
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:2008
                                                                                                                                      • C:\Users\Admin\Desktop\CucumberPerm.exe
                                                                                                                                        "C:\Users\Admin\Desktop\CucumberPerm.exe"
                                                                                                                                        1⤵
                                                                                                                                          PID:2064
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\70C1.tmp\70C2.tmp\70C3.bat C:\Users\Admin\Desktop\CucumberPerm.exe"
                                                                                                                                            2⤵
                                                                                                                                              PID:1356
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\Cucumber-Permanently-Spoofer.exe
                                                                                                                                                Cucumber-Permanently-Spoofer.exe
                                                                                                                                                3⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:3680
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c mode con: cols=50 lines=20
                                                                                                                                                  4⤵
                                                                                                                                                    PID:3664
                                                                                                                                                    • C:\Windows\system32\mode.com
                                                                                                                                                      mode con: cols=50 lines=20
                                                                                                                                                      5⤵
                                                                                                                                                        PID:700
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c title %computername%
                                                                                                                                                      4⤵
                                                                                                                                                        PID:4444
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c cls
                                                                                                                                                        4⤵
                                                                                                                                                          PID:4200
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c taskkill /F /IM EpicGamesLauncher.exe >nul 2>&1
                                                                                                                                                          4⤵
                                                                                                                                                            PID:3840
                                                                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                                                                              taskkill /F /IM EpicGamesLauncher.exe
                                                                                                                                                              5⤵
                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                              PID:5056
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheatLauncher.exe >nul 2>&1
                                                                                                                                                            4⤵
                                                                                                                                                              PID:928
                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                taskkill /F /IM EasyAntiCheatLauncher.exe
                                                                                                                                                                5⤵
                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                PID:2476
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c taskkill /F /IM BEService.exe >nul 2>&1
                                                                                                                                                              4⤵
                                                                                                                                                                PID:2096
                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                  taskkill /F /IM BEService.exe
                                                                                                                                                                  5⤵
                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                  PID:4880
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c taskkill /F /IM Fortnite.exe >nul 2>&1
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:1328
                                                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                                                    taskkill /F /IM Fortnite.exe
                                                                                                                                                                    5⤵
                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                    PID:4640
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c taskkill /F /IM BattleEyeLauncher.exe >nul 2>&1
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:4760
                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                      taskkill /F /IM BattleEyeLauncher.exe
                                                                                                                                                                      5⤵
                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                      PID:4972
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping.exe >nul 2>&1
                                                                                                                                                                    4⤵
                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                    PID:820
                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                      taskkill /F /IM FortniteClient-Win64-Shipping.exe
                                                                                                                                                                      5⤵
                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                      PID:2716
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc stop BEService >nul 2>&1
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:4100
                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                        sc stop BEService
                                                                                                                                                                        5⤵
                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                        PID:2524
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc stop BEDaisy >nul 2>&1
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:4184
                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                          sc stop BEDaisy
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                          PID:1320
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc stop EasyAntiCheat >nul 2>&1
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:4120
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            sc stop EasyAntiCheat
                                                                                                                                                                            5⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:4176
                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc stop EasyAntiCheatSys >nul 2>&1
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:624
                                                                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                                                                              sc stop EasyAntiCheatSys
                                                                                                                                                                              5⤵
                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                              PID:3376
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c cls
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:64
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c Disk1.exe
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:4832
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\Disk1.exe
                                                                                                                                                                                  Disk1.exe
                                                                                                                                                                                  5⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:4360
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c Disk2.exe
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:4552
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\Disk2.exe
                                                                                                                                                                                    Disk2.exe
                                                                                                                                                                                    5⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:3232
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Spoof.bat
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:2000
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                      inertia.exe /IVN 7931-9431-18476
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:68
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                      inertia.exe /IV 13733-17470-15122
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Cerber
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:2372
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                      inertia.exe /IV 14255-960-27200
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Cerber
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:3044
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                      inertia.exe /SM 25941-31817-8962
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:2508
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                      inertia.exe /SP 8069-32165-14144
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Cerber
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:2148
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                      inertia.exe /SV 25004-8988-2402
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:5084
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                      inertia.exe /SS 20670-24142-21540
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Cerber
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:4080
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                      inertia.exe /SU AUTO
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:2804
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                      inertia.exe /SK 31426-887-29916
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Cerber
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:652
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                      inertia.exe /SF 14991-9854-19339
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Cerber
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:1456
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                      inertia.exe /BM 516-3366-16843
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:1120
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                      inertia.exe /BP 15534-28863-22733
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Cerber
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:3596
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                      inertia.exe /BV 31884-902-17959
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Cerber
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:1508
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                      inertia.exe /BS 11529-3014-5716
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:3088
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                      inertia.exe /BT 8072-29119-14420
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Cerber
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:4496
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                      inertia.exe /BLC 22743-22201-19007
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:3384
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                      inertia.exe /CM 17884-14190-16557
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Cerber
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:5096
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                      inertia.exe /CV 10624-17921-32124
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Cerber
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:4748
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                      inertia.exe /CS 14917-31661-11226
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:4260
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                      inertia.exe /CA 27408-30568-2273
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:5048
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                      inertia.exe /CSK 13219-19910-18518
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Cerber
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:4356
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                      inertia.exe /PSN 30000-29363-8424
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:512
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                      inertia.exe /PAT 18745-486-9134
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:3780
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                      inertia.exe /PPN 30937-12286-29715
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Cerber
                                                                                                                                                                                      PID:4980
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                      inertia.exe /OS 1 764-15796-11362
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Cerber
                                                                                                                                                                                      PID:312
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                      inertia.exe /OS 2 17479-20346-31024
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:2216
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                        inertia.exe /OS 3 3664-31642-17263
                                                                                                                                                                                        5⤵
                                                                                                                                                                                        • Cerber
                                                                                                                                                                                        PID:2192
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                        inertia.exe /OS 4 15303-9834-25071
                                                                                                                                                                                        5⤵
                                                                                                                                                                                        • Cerber
                                                                                                                                                                                        PID:1504
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                        inertia.exe /OS 5 6593-23831-5350
                                                                                                                                                                                        5⤵
                                                                                                                                                                                          PID:1472
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                          inertia.exe /OS 6 24954-29545-7048
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • Cerber
                                                                                                                                                                                          PID:2940
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                          inertia.exe /OS 7 31387-17280-12580
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:4712
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                            inertia.exe /OS 8 24367-16475-10846
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:1052
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                              inertia.exe /OS 9 5483-9202-26756
                                                                                                                                                                                              5⤵
                                                                                                                                                                                              • Cerber
                                                                                                                                                                                              PID:1016
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                              inertia.exe /OS 10 27853-17062-20205
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:700
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\inertia.exe
                                                                                                                                                                                                inertia.exe /OS 11 7890-13924-27037
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                • Cerber
                                                                                                                                                                                                PID:5068
                                                                                                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                                                                                                net stop winmgmt /Y
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                  PID:3160
                                                                                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                                                                                    C:\Windows\system32\net1 stop winmgmt /Y
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:400
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c net stop winmgmt /y
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:1080
                                                                                                                                                                                                    • C:\Windows\system32\net.exe
                                                                                                                                                                                                      net stop winmgmt /y
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                        PID:4620
                                                                                                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                                                                                                          C:\Windows\system32\net1 stop winmgmt /y
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:2860
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c net start winmgmt /y
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:372
                                                                                                                                                                                                          • C:\Windows\system32\net.exe
                                                                                                                                                                                                            net start winmgmt /y
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                              PID:1272
                                                                                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                C:\Windows\system32\net1 start winmgmt /y
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                  PID:2800
                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc stop winmgmt
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:4276
                                                                                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                  sc stop winmgmt
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                  PID:4224
                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c sc start winmgmt
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:4364
                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                    sc start winmgmt
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                    PID:3900
                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c mode con: cols=50 lines=20
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:1104
                                                                                                                                                                                                                    • C:\Windows\system32\mode.com
                                                                                                                                                                                                                      mode con: cols=50 lines=20
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                        PID:3232
                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c title %computername%
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:2692
                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c cls
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                          PID:2920
                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c cls
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:1188
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c start cleaner.exe
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                              PID:2436
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\cleaner.exe
                                                                                                                                                                                                                                cleaner.exe
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                                                                • Checks system information in the registry
                                                                                                                                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                PID:3160
                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c taskkill /f /im EpicGamesLauncher.exe >nul 2>&1
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                    PID:3100
                                                                                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                      taskkill /f /im EpicGamesLauncher.exe
                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                      PID:3280
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&1
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                    PID:4808
                                                                                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                      taskkill /f /im FortniteClient-Win64-Shipping.exe
                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                      PID:64
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c taskkill /f /im Battle.net.exe >nul 2>&1
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                      PID:4384
                                                                                                                                                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                        taskkill /f /im Battle.net.exe
                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                        PID:3024
                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c start https://applecheats.cc
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                      PID:3228
                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c pause
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                        PID:3664
                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c cls
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                          PID:2596
                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c NETSH WINSOCK RESET >nul 2>&1
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                            PID:3568
                                                                                                                                                                                                                                            • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                              NETSH WINSOCK RESET
                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                                              PID:3336
                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c NETSH INT IP RESET >nul 2>&1
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                              PID:5028
                                                                                                                                                                                                                                              • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                NETSH INT IP RESET
                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                                                PID:3888
                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c netsh advfirewall reset >nul 2>&1
                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                PID:3000
                                                                                                                                                                                                                                                • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                  netsh advfirewall reset
                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                                                  PID:3908
                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c NETSH INTERFACE IPV4 RESET >nul 2>&1
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                  PID:3100
                                                                                                                                                                                                                                                  • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                    NETSH INTERFACE IPV4 RESET
                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                                                    PID:5016
                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c NETSH INTERFACE IPV6 RESET >nul 2>&1
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                    PID:4808
                                                                                                                                                                                                                                                    • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                      NETSH INTERFACE IPV6 RESET
                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                                                      PID:4072
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c NETSH INTERFACE TCP RESET >nul 2>&1
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                      PID:4140
                                                                                                                                                                                                                                                      • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                        NETSH INTERFACE TCP RESET
                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                                                        PID:2788
                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c NETSH INT RESET ALL >nul 2>&1
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                        PID:2512
                                                                                                                                                                                                                                                        • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                          NETSH INT RESET ALL
                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                                                          PID:4788
                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c IPCONFIG /RELEASE >nul 2>&1
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                          PID:2780
                                                                                                                                                                                                                                                          • C:\Windows\system32\ipconfig.exe
                                                                                                                                                                                                                                                            IPCONFIG /RELEASE
                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                            • Gathers network information
                                                                                                                                                                                                                                                            PID:4276
                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c IPCONFIG /RELEASE >nul 2>&1
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                            PID:192
                                                                                                                                                                                                                                                            • C:\Windows\system32\ipconfig.exe
                                                                                                                                                                                                                                                              IPCONFIG /RELEASE
                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                              • Gathers network information
                                                                                                                                                                                                                                                              PID:5040
                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c IPCONFIG /FLUSHDNS >nul 2>&1
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                              PID:1884
                                                                                                                                                                                                                                                              • C:\Windows\system32\ipconfig.exe
                                                                                                                                                                                                                                                                IPCONFIG /FLUSHDNS
                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                • Gathers network information
                                                                                                                                                                                                                                                                PID:4732
                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c NBTSTAT -R >nul 2>&1
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                PID:4736
                                                                                                                                                                                                                                                                • C:\Windows\system32\nbtstat.exe
                                                                                                                                                                                                                                                                  NBTSTAT -R
                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                    PID:2076
                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c NBTSTAT -RR >nul 2>&1
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                    PID:1508
                                                                                                                                                                                                                                                                    • C:\Windows\system32\nbtstat.exe
                                                                                                                                                                                                                                                                      NBTSTAT -RR
                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                        PID:3088
                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c arp -a >nul 2>&1
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                      • Network Service Discovery
                                                                                                                                                                                                                                                                      PID:1908
                                                                                                                                                                                                                                                                      • C:\Windows\system32\ARP.EXE
                                                                                                                                                                                                                                                                        arp -a
                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                        • Network Service Discovery
                                                                                                                                                                                                                                                                        PID:5096
                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c arp -d >nul 2>&1
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                        PID:3384
                                                                                                                                                                                                                                                                        • C:\Windows\system32\ARP.EXE
                                                                                                                                                                                                                                                                          arp -d
                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                            PID:756
                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c WMIC PATH WIN32_NETWORKADAPTER WHERE PHYSICALADAPTER=TRUE CALL DISABLE >nul 2>&1
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                            PID:1420
                                                                                                                                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                              WMIC PATH WIN32_NETWORKADAPTER WHERE PHYSICALADAPTER=TRUE CALL DISABLE
                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                PID:3188
                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c mode con: cols=50 lines=20
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                            PID:2856
                                                                                                                                                                                                                                                                            • C:\Windows\system32\mode.com
                                                                                                                                                                                                                                                                              mode con: cols=50 lines=20
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                PID:1080
                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c title %computername%
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:4696
                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c cls
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                  PID:4224
                                                                                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -s Winmgmt
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:3000
                                                                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -s Winmgmt
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                              PID:3568
                                                                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -s Winmgmt
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:4604
                                                                                                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\svchost.exe -k netsvcs -s Winmgmt
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                PID:3900
                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                PID:3932
                                                                                                                                                                                                                                                                              • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                PID:4168
                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                PID:220
                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                PID:4964
                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                PID:4480

                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF83303B62A7F75716.TMP

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                16KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                2d25774a6660a03a4cbfc5e88d888a06

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                7d7e115a6f0b7948f15b6c0303d5d5bd483168ed

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                f6639758204f80dbcacc1a606ce721c079acc1b1bf305eeda666254a2cd318b4

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                b0e95e4dbb1aed6ba3bb55e71c2451288b8dc36886d655e9c70c4d91c18c05ec49919eb2f1b18c84428cb627d34228067752329505189bdb1da6f55baaaa6fd4

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\70C1.tmp\cleaner.exe

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                3.6MB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                f96eb2236970fb3ea97101b923af4228

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                e0eed80f1054acbf5389a7b8860a4503dd3e184a

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                46fe5192387d3f897a134d29c069ebf39c72094c892134d2f0e77b12b11a6172

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                2fd2d28c5f571d40b43a4dd7a22d367ba42420c29627f21ca0a2052070ffb9f689d80dad638238189eed26ed19af626f47e70f1207e10007041c620dac323cc7

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\C7F0.tmp\C7F1.bat

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                49B

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                76c808e336da42d4752793ac9e4d2de9

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                ee8a0c27f7365758bf4c8984e6db68cbb80edf1f

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                9544700233e231b3925cd07cf382b6f43c12f1d974e44cad084950c418712823

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                d945a0f4cfc11f39214927e4117837cf39427eaf733c91a525ca89a504afa13ade5ad35de090d7af38634c9944b9a09c7fff8f5f400e501cc61d4f95e7c5cb1a

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\Cucumber-Permanently-Spoofer.exe

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                211KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                0182aba8c667b5110f198c5058205c58

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                4508ce27dacdd910bdd768f28fd392eda6fed528

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                52b28946d63a85200a05c77ba866bc02a1f19b99f2894b312bbd7ad2ad887885

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                c9f04c1564601d65bb0ad2c2165fd7bf77697d49b7fb511f367e6d3ef22ba4c1bb075e653b967c4afc5f72e780d80b78f31697d85d09a0fc7a79bba2a5ea9bfe

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\Disk1.exe

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                228KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                4d867033b27c8a603de4885b449c4923

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                f1ace1a241bab6efb3c7059a68b6e9bbe258da83

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                22a2484d7fa799e6e71e310141614884f3bc8dad8ac749b6f1c475b5398a72f3

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                b5d6d4a58d8780a43e69964f80525905224fa020c0032e637cd25557097e331f63d156cceaaacfe1a692ca8cea8d8bd1b219468b6b8e4827c90febe1535a5702

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\Disk2.exe

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                165KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                81a45f1a91448313b76d2e6d5308aa7a

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                0d615343d5de03da03bce52e11b233093b404083

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                fb0d02ea26bb1e5df5a07147931caf1ae3d7d1d9b4d83f168b678e7f3a1c0ecd

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                675662f84dfcbf33311f5830db70bff50b6e8a34a4a926de6369c446ea2b1cf8a63e9c94e5a5c2e1d226248f0361a1698448f82118ac4de5a92b64d8fdf8815d

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\inertia.exe

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                453KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                7f118633f542014d65ee13eb8d4f702a

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                a59117813003390187a45eec4116337d5b695b09

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                e27be45f00bce92b6f3c12e37723295e5a5959ecb8185f06028f3cfb88de3bb6

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                cf004560d6e3ce5cbb142a91445427dce58199dd3d1a254d2ae6d2e41df709c90844edfe9eff711c0a042f05338d72588da25591149edfd90860a76e2b0c9ff8

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\C7EF.tmp\spoof.bat

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                8f4af8f8316597bee403a4a1ec435efb

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                a748c6d08d4af712ce290b5a96f46a8bde2d8fb8

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                9f2d4182cc30ff70228ccfc599d9afbed9aa21557802b2a422c643b9c7293f4b

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                60e07665d7e4d8369b83663ff2966abed1d22c28a9cfbb9222358d9c88d08791e848fd11246d6398864780f76162e06bccf975f8a2b988a3f18a5b4b6817adf6

                                                                                                                                                                                                                                                                              • memory/3160-109-0x00007FF707CB0000-0x00007FF708652000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                9.6MB

                                                                                                                                                                                                                                                                              • memory/3160-110-0x00007FF707CB0000-0x00007FF708652000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                9.6MB

                                                                                                                                                                                                                                                                              • memory/3160-111-0x00007FF707CB0000-0x00007FF708652000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                9.6MB

                                                                                                                                                                                                                                                                              • memory/3160-112-0x00007FF707CB0000-0x00007FF708652000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                9.6MB

                                                                                                                                                                                                                                                                              • memory/3160-113-0x00007FF707CB0000-0x00007FF708652000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                9.6MB

                                                                                                                                                                                                                                                                              • memory/3160-108-0x00007FF707CB0000-0x00007FF708652000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                9.6MB

                                                                                                                                                                                                                                                                              • memory/3160-355-0x00007FF707CB0000-0x00007FF708652000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                9.6MB

                                                                                                                                                                                                                                                                              • memory/3932-114-0x000002F703020000-0x000002F703030000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                                                                              • memory/3932-131-0x000002F703130000-0x000002F703140000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                                                                              • memory/3932-149-0x000002F700690000-0x000002F700692000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                              • memory/3932-551-0x000002F700680000-0x000002F700681000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/3932-547-0x000002F7006C0000-0x000002F7006C1000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/3932-544-0x000002F7022E0000-0x000002F7022E2000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                              • memory/4480-204-0x000001C82EB90000-0x000001C82EB92000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                              • memory/4480-176-0x000001C82DB10000-0x000001C82DB12000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                              • memory/4480-174-0x000001C82D9F0000-0x000001C82D9F2000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                              • memory/4480-178-0x000001C82DBD0000-0x000001C82DBD2000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                              • memory/4480-202-0x000001C82EB70000-0x000001C82EB72000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                              • memory/4480-200-0x000001C82EB50000-0x000001C82EB52000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                              • memory/4480-335-0x000001C8306A0000-0x000001C8307A0000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1024KB

                                                                                                                                                                                                                                                                              • memory/4480-171-0x000001C81D080000-0x000001C81D0A0000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                                              • memory/4480-170-0x000001C81D700000-0x000001C81D800000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1024KB

                                                                                                                                                                                                                                                                              • memory/4964-156-0x0000024E7D840000-0x0000024E7D940000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1024KB

                                                                                                                                                                                                                                                                              • memory/4964-157-0x0000024E7D840000-0x0000024E7D940000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1024KB

                                                                                                                                                                                                                                                                              • memory/4964-158-0x0000024E7D840000-0x0000024E7D940000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1024KB