Overview

overview

10

Static

static

3

4424ff327f...18.exe

windows7-x64

10

4424ff327f...18.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    78s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2024, 20:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4424ff327fc46ccbf1e122212df6f6c0_JaffaCakes118.exe

  • Size

    993KB

  • MD5

    4424ff327fc46ccbf1e122212df6f6c0

  • SHA1

    b1d555f699b5c1f04cf05b5a09f7c03195275b71

  • SHA256

    34699231be16c5d6a5e12d69fa97ae4c2e8c243894d6f22feb6d8c0686a99f0b

  • SHA512

    91c752aa8d6e5f27f783f16c518ea41c3d3cd1d11eb610447a4b268ffa280489c51ca70ed46b4797aa5d8f8d581e98f6e97c45a62b4ac25fe9b5b7429846d9cf

  • SSDEEP

    24576:2AojG2m6TtySYXU9/UwlPGhnxy4i9XCWsu5agFya3T5OeZINOh:A/PtySL9/UwluhnhuyWZagdTcuIQh

Score
10/10
darkcometdyn-noipdiscoveryevasionpersistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

Dyn-NoIp

C2

rezausa.no-ip.org:3030

rezausa.dyndns.org:3030
Mutex

DC_MUTEX-S2T3FWA

Attributes
  • InstallPath

    taskhost.exe

  • gencode

    MR9sLp0UQRG4

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Modifies WinLogon for persistence 2 TTPs 42 IoCs
    persistence
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 42 IoCs
    evasion
  • Sets file to hidden 1 TTPs 64 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • Checks BIOS information in registry 2 TTPs 42 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Identifies Wine through registry keys 2 TTPs 42 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 42 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 42 IoCs
    evasiontrojan
  • Drops file in System32 directory 64 IoCs
  • Suspicious use of SetThreadContext 42 IoCs
  • UPX packed file 46 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 42 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\4424ff327fc46ccbf1e122212df6f6c0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4424ff327fc46ccbf1e122212df6f6c0_JaffaCakes118.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Checks whether UAC is enabled
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2396
    • C:\Users\Admin\AppData\Local\Temp\4424ff327fc46ccbf1e122212df6f6c0_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\4424ff327fc46ccbf1e122212df6f6c0_JaffaCakes118.exe
      2⤵
      • Modifies WinLogon for persistence
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2512
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\4424ff327fc46ccbf1e122212df6f6c0_JaffaCakes118.exe" +s +h
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2900
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Users\Admin\AppData\Local\Temp\4424ff327fc46ccbf1e122212df6f6c0_JaffaCakes118.exe" +s +h
          4⤵
            PID:2672
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2676
          • C:\Windows\SysWOW64\attrib.exe
            attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
            4⤵
            • Sets file to hidden
            PID:2680
        • C:\Windows\SysWOW64\notepad.exe
          notepad
          3⤵
          • Deletes itself
          PID:2704
        • C:\Windows\SysWOW64\taskhost.exe
          "C:\Windows\system32\taskhost.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Checks whether UAC is enabled
          • Suspicious use of SetThreadContext
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2700
          • C:\Windows\SysWOW64\taskhost.exe
            C:\Windows\SysWOW64\taskhost.exe
            4⤵
            • Modifies WinLogon for persistence
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Drops file in System32 directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1904
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\taskhost.exe" +s +h
              5⤵
                PID:1072
                • C:\Windows\SysWOW64\attrib.exe
                  attrib "C:\Windows\SysWOW64\taskhost.exe" +s +h
                  6⤵
                    PID:2408
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64" +s +h
                  5⤵
                    PID:2096
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib "C:\Windows\SysWOW64" +s +h
                      6⤵
                      • Sets file to hidden
                      • Drops file in Windows directory
                      PID:2424
                  • C:\Windows\SysWOW64\notepad.exe
                    notepad
                    5⤵
                      PID:2108
                    • C:\Windows\SysWOW64\MR9sLp0UQRG4\taskhost.exe
                      "C:\Windows\system32\MR9sLp0UQRG4\taskhost.exe"
                      5⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Checks whether UAC is enabled
                      • Suspicious use of SetThreadContext
                      • Suspicious use of SetWindowsHookEx
                      PID:2452
                      • C:\Windows\SysWOW64\MR9sLp0UQRG4\taskhost.exe
                        C:\Windows\SysWOW64\MR9sLp0UQRG4\taskhost.exe
                        6⤵
                        • Modifies WinLogon for persistence
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Adds Run key to start application
                        • Drops file in System32 directory
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1672
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\taskhost.exe" +s +h
                          7⤵
                            PID:3040
                            • C:\Windows\SysWOW64\attrib.exe
                              attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\taskhost.exe" +s +h
                              8⤵
                              • Sets file to hidden
                              • Drops file in System32 directory
                              • Views/modifies file attributes
                              PID:696
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4" +s +h
                            7⤵
                              PID:972
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4" +s +h
                                8⤵
                                • System Location Discovery: System Language Discovery
                                • Views/modifies file attributes
                                PID:1540
                            • C:\Windows\SysWOW64\notepad.exe
                              notepad
                              7⤵
                                PID:2040
                              • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                7⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Checks whether UAC is enabled
                                • Suspicious use of SetThreadContext
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of SetWindowsHookEx
                                PID:816
                                • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                  C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                  8⤵
                                  • Modifies WinLogon for persistence
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Adds Run key to start application
                                  PID:2644
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                    9⤵
                                      PID:1192
                                      • C:\Windows\SysWOW64\attrib.exe
                                        attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                        10⤵
                                        • Sets file to hidden
                                        • Drops file in System32 directory
                                        PID:2716
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                      9⤵
                                        PID:2608
                                        • C:\Windows\SysWOW64\attrib.exe
                                          attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                          10⤵
                                            PID:2788
                                        • C:\Windows\SysWOW64\notepad.exe
                                          notepad
                                          9⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:2868
                                        • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                          "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                          9⤵
                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                          • Checks BIOS information in registry
                                          • Executes dropped EXE
                                          • Identifies Wine through registry keys
                                          • Checks whether UAC is enabled
                                          • Drops file in System32 directory
                                          • Suspicious use of SetThreadContext
                                          • Suspicious use of SetWindowsHookEx
                                          PID:2888
                                          • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                            C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                            10⤵
                                            • Modifies WinLogon for persistence
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Adds Run key to start application
                                            • Drops file in System32 directory
                                            PID:2956
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                              11⤵
                                                PID:236
                                                • C:\Windows\SysWOW64\attrib.exe
                                                  attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                  12⤵
                                                  • Sets file to hidden
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2568
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                11⤵
                                                  PID:2248
                                                  • C:\Windows\SysWOW64\attrib.exe
                                                    attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                    12⤵
                                                    • Sets file to hidden
                                                    PID:1684
                                                • C:\Windows\SysWOW64\notepad.exe
                                                  notepad
                                                  11⤵
                                                    PID:840
                                                  • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                    "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                    11⤵
                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                    • Checks BIOS information in registry
                                                    • Executes dropped EXE
                                                    • Identifies Wine through registry keys
                                                    • Checks whether UAC is enabled
                                                    • Suspicious use of SetThreadContext
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2636
                                                    • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                      C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                      12⤵
                                                      • Modifies WinLogon for persistence
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Adds Run key to start application
                                                      • Drops file in System32 directory
                                                      PID:2228
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                        13⤵
                                                          PID:1028
                                                          • C:\Windows\SysWOW64\attrib.exe
                                                            attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                            14⤵
                                                            • Sets file to hidden
                                                            PID:2776
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                          13⤵
                                                            PID:2260
                                                            • C:\Windows\SysWOW64\attrib.exe
                                                              attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                              14⤵
                                                              • Sets file to hidden
                                                              • Views/modifies file attributes
                                                              PID:1724
                                                          • C:\Windows\SysWOW64\notepad.exe
                                                            notepad
                                                            13⤵
                                                              PID:2268
                                                            • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                              "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                              13⤵
                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                              • Checks BIOS information in registry
                                                              • Executes dropped EXE
                                                              • Identifies Wine through registry keys
                                                              • Checks whether UAC is enabled
                                                              • Suspicious use of SetThreadContext
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:2612
                                                              • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                14⤵
                                                                • Modifies WinLogon for persistence
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Adds Run key to start application
                                                                PID:1660
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                  15⤵
                                                                    PID:2068
                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                      attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                      16⤵
                                                                      • Drops file in System32 directory
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Views/modifies file attributes
                                                                      PID:576
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                    15⤵
                                                                      PID:2680
                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                        attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                        16⤵
                                                                        • Sets file to hidden
                                                                        • Views/modifies file attributes
                                                                        PID:1176
                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                      notepad
                                                                      15⤵
                                                                        PID:2724
                                                                      • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                        "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                        15⤵
                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                        • Checks BIOS information in registry
                                                                        • Executes dropped EXE
                                                                        • Identifies Wine through registry keys
                                                                        • Checks whether UAC is enabled
                                                                        • Suspicious use of SetThreadContext
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:308
                                                                        • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                          C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                          16⤵
                                                                          • Modifies WinLogon for persistence
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Adds Run key to start application
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:2312
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                            17⤵
                                                                              PID:824
                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                18⤵
                                                                                  PID:2636
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                17⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:460
                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                  attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                  18⤵
                                                                                    PID:1804
                                                                                • C:\Windows\SysWOW64\notepad.exe
                                                                                  notepad
                                                                                  17⤵
                                                                                    PID:712
                                                                                  • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                    "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                    17⤵
                                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                    • Checks BIOS information in registry
                                                                                    • Executes dropped EXE
                                                                                    • Identifies Wine through registry keys
                                                                                    • Checks whether UAC is enabled
                                                                                    • Suspicious use of SetThreadContext
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:2088
                                                                                    • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                      C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                      18⤵
                                                                                      • Modifies WinLogon for persistence
                                                                                      • Executes dropped EXE
                                                                                      • Loads dropped DLL
                                                                                      • Adds Run key to start application
                                                                                      • Drops file in System32 directory
                                                                                      PID:2324
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                        19⤵
                                                                                          PID:2760
                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                            attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                            20⤵
                                                                                              PID:2292
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                            19⤵
                                                                                              PID:1476
                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                20⤵
                                                                                                  PID:2300
                                                                                              • C:\Windows\SysWOW64\notepad.exe
                                                                                                notepad
                                                                                                19⤵
                                                                                                  PID:1216
                                                                                                • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                  "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                  19⤵
                                                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                  • Checks BIOS information in registry
                                                                                                  • Executes dropped EXE
                                                                                                  • Identifies Wine through registry keys
                                                                                                  • Checks whether UAC is enabled
                                                                                                  • Suspicious use of SetThreadContext
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:2116
                                                                                                  • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                    C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                    20⤵
                                                                                                    • Modifies WinLogon for persistence
                                                                                                    • Executes dropped EXE
                                                                                                    • Loads dropped DLL
                                                                                                    • Adds Run key to start application
                                                                                                    • Drops file in System32 directory
                                                                                                    PID:544
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                      21⤵
                                                                                                        PID:2456
                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                          attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                          22⤵
                                                                                                          • Sets file to hidden
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:1412
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                        21⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:2496
                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                          attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                          22⤵
                                                                                                          • Sets file to hidden
                                                                                                          • Drops file in System32 directory
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Views/modifies file attributes
                                                                                                          PID:2564
                                                                                                      • C:\Windows\SysWOW64\notepad.exe
                                                                                                        notepad
                                                                                                        21⤵
                                                                                                          PID:2404
                                                                                                        • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                          "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                          21⤵
                                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                          • Checks BIOS information in registry
                                                                                                          • Executes dropped EXE
                                                                                                          • Identifies Wine through registry keys
                                                                                                          • Checks whether UAC is enabled
                                                                                                          • Suspicious use of SetThreadContext
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:2700
                                                                                                          • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                            C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                            22⤵
                                                                                                            • Modifies WinLogon for persistence
                                                                                                            • Executes dropped EXE
                                                                                                            • Loads dropped DLL
                                                                                                            • Adds Run key to start application
                                                                                                            PID:2236
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                              23⤵
                                                                                                                PID:1332
                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                  attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                  24⤵
                                                                                                                  • Views/modifies file attributes
                                                                                                                  PID:3064
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                23⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:1124
                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                  attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                  24⤵
                                                                                                                  • Sets file to hidden
                                                                                                                  • Views/modifies file attributes
                                                                                                                  PID:2864
                                                                                                              • C:\Windows\SysWOW64\notepad.exe
                                                                                                                notepad
                                                                                                                23⤵
                                                                                                                  PID:2020
                                                                                                                • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                  "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                  23⤵
                                                                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                  • Checks BIOS information in registry
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Identifies Wine through registry keys
                                                                                                                  • Checks whether UAC is enabled
                                                                                                                  • Drops file in System32 directory
                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:952
                                                                                                                  • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                    C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                    24⤵
                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Loads dropped DLL
                                                                                                                    • Adds Run key to start application
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:436
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                      25⤵
                                                                                                                        PID:2072
                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                          attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                          26⤵
                                                                                                                          • Views/modifies file attributes
                                                                                                                          PID:2400
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                        25⤵
                                                                                                                          PID:2836
                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                            attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                            26⤵
                                                                                                                            • Sets file to hidden
                                                                                                                            • Drops file in System32 directory
                                                                                                                            PID:2736
                                                                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                                                                          notepad
                                                                                                                          25⤵
                                                                                                                            PID:2936
                                                                                                                          • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                            "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                            25⤵
                                                                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                            • Checks BIOS information in registry
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Identifies Wine through registry keys
                                                                                                                            • Checks whether UAC is enabled
                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:2916
                                                                                                                            • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                              C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                              26⤵
                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Loads dropped DLL
                                                                                                                              • Adds Run key to start application
                                                                                                                              • Drops file in System32 directory
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:1068
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                27⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:1740
                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                  attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                  28⤵
                                                                                                                                  • Drops file in System32 directory
                                                                                                                                  • Views/modifies file attributes
                                                                                                                                  PID:2744
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                27⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:2428
                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                  attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                  28⤵
                                                                                                                                  • Sets file to hidden
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  • Views/modifies file attributes
                                                                                                                                  PID:2180
                                                                                                                              • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                notepad
                                                                                                                                27⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:1716
                                                                                                                              • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                27⤵
                                                                                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                • Checks BIOS information in registry
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Identifies Wine through registry keys
                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:2856
                                                                                                                                • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                  C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                  28⤵
                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  • Adds Run key to start application
                                                                                                                                  • Drops file in System32 directory
                                                                                                                                  PID:1416
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                    29⤵
                                                                                                                                      PID:2212
                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                        attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                        30⤵
                                                                                                                                        • Sets file to hidden
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        PID:1956
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                      29⤵
                                                                                                                                        PID:2848
                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                          attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                          30⤵
                                                                                                                                            PID:280
                                                                                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                          notepad
                                                                                                                                          29⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:1704
                                                                                                                                        • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                          "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                          29⤵
                                                                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Identifies Wine through registry keys
                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:2452
                                                                                                                                          • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                            C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                            30⤵
                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            • Adds Run key to start application
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            PID:2692
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                              31⤵
                                                                                                                                                PID:2168
                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                  attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                  32⤵
                                                                                                                                                  • Sets file to hidden
                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                  PID:2720
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                31⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:772
                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                  attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                  32⤵
                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                  PID:2632
                                                                                                                                              • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                notepad
                                                                                                                                                31⤵
                                                                                                                                                  PID:1440
                                                                                                                                                • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                  "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                  31⤵
                                                                                                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                  • Checks BIOS information in registry
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Identifies Wine through registry keys
                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  PID:576
                                                                                                                                                  • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                    C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                    32⤵
                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                    PID:1996
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                      33⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:1732
                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                        attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                        34⤵
                                                                                                                                                        • Sets file to hidden
                                                                                                                                                        PID:3064
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                      33⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:2408
                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                        attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                        34⤵
                                                                                                                                                        • Sets file to hidden
                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                        PID:816
                                                                                                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                      notepad
                                                                                                                                                      33⤵
                                                                                                                                                        PID:1888
                                                                                                                                                      • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                        "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                        33⤵
                                                                                                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Identifies Wine through registry keys
                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                        PID:2872
                                                                                                                                                        • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                          C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                          34⤵
                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:2632
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                            35⤵
                                                                                                                                                              PID:2656
                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                36⤵
                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                PID:2100
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                              35⤵
                                                                                                                                                                PID:2704
                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                  36⤵
                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                  PID:1756
                                                                                                                                                              • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                notepad
                                                                                                                                                                35⤵
                                                                                                                                                                  PID:2384
                                                                                                                                                                • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                  "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                  35⤵
                                                                                                                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                  • Checks BIOS information in registry
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Identifies Wine through registry keys
                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                  PID:1960
                                                                                                                                                                  • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                    C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                    36⤵
                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                    PID:2148
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                      37⤵
                                                                                                                                                                        PID:2172
                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                          38⤵
                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                          PID:2036
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                        37⤵
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:2492
                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                          38⤵
                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                          PID:1756
                                                                                                                                                                      • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                        notepad
                                                                                                                                                                        37⤵
                                                                                                                                                                          PID:2872
                                                                                                                                                                        • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                          "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                          37⤵
                                                                                                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Identifies Wine through registry keys
                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                          PID:1676
                                                                                                                                                                          • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                            C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                            38⤵
                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                            PID:560
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                              39⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:2120
                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                40⤵
                                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                                PID:1492
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                              39⤵
                                                                                                                                                                                PID:1624
                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                  40⤵
                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                  PID:1404
                                                                                                                                                                              • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                notepad
                                                                                                                                                                                39⤵
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:1420
                                                                                                                                                                              • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                39⤵
                                                                                                                                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Identifies Wine through registry keys
                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                PID:316
                                                                                                                                                                                • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                  C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                  40⤵
                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                  PID:2060
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                    41⤵
                                                                                                                                                                                      PID:2636
                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                        42⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                        PID:1540
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                      41⤵
                                                                                                                                                                                        PID:1708
                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                          42⤵
                                                                                                                                                                                            PID:2592
                                                                                                                                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                          notepad
                                                                                                                                                                                          41⤵
                                                                                                                                                                                            PID:1412
                                                                                                                                                                                          • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                            "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                            41⤵
                                                                                                                                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Identifies Wine through registry keys
                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                            PID:2740
                                                                                                                                                                                            • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                              C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                              42⤵
                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                              PID:1176
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                43⤵
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:268
                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                  44⤵
                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                  PID:2864
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                43⤵
                                                                                                                                                                                                  PID:1044
                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                    44⤵
                                                                                                                                                                                                      PID:3028
                                                                                                                                                                                                  • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                    notepad
                                                                                                                                                                                                    43⤵
                                                                                                                                                                                                      PID:2696
                                                                                                                                                                                                    • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                      "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                      43⤵
                                                                                                                                                                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Identifies Wine through registry keys
                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                      PID:816
                                                                                                                                                                                                      • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                        C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                        44⤵
                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                        PID:1156
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                          45⤵
                                                                                                                                                                                                            PID:2988
                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                              46⤵
                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                              PID:2508
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                            45⤵
                                                                                                                                                                                                              PID:788
                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                46⤵
                                                                                                                                                                                                                  PID:2412
                                                                                                                                                                                                              • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                notepad
                                                                                                                                                                                                                45⤵
                                                                                                                                                                                                                  PID:2448
                                                                                                                                                                                                                • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                  "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                  45⤵
                                                                                                                                                                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                  • Checks BIOS information in registry
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Identifies Wine through registry keys
                                                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                  PID:1404
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                    C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                    46⤵
                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                    PID:2824
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                      47⤵
                                                                                                                                                                                                                        PID:1676
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                          48⤵
                                                                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                                                                          PID:780
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                        47⤵
                                                                                                                                                                                                                          PID:2164
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                            48⤵
                                                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                                                            PID:2612
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                          notepad
                                                                                                                                                                                                                          47⤵
                                                                                                                                                                                                                            PID:856
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                            "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                            47⤵
                                                                                                                                                                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Identifies Wine through registry keys
                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                            PID:2100
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                              48⤵
                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                              PID:3012
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                49⤵
                                                                                                                                                                                                                                  PID:3104
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                    50⤵
                                                                                                                                                                                                                                      PID:3296
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                    49⤵
                                                                                                                                                                                                                                      PID:3112
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                        50⤵
                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                        PID:3324
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                      notepad
                                                                                                                                                                                                                                      49⤵
                                                                                                                                                                                                                                        PID:3120
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                        "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                        49⤵
                                                                                                                                                                                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Identifies Wine through registry keys
                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                        PID:3304
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                          C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                          50⤵
                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                          PID:3444
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                            51⤵
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:3516
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                              52⤵
                                                                                                                                                                                                                                              • Sets file to hidden
                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                              PID:3704
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                            51⤵
                                                                                                                                                                                                                                              PID:3532
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                52⤵
                                                                                                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                PID:3712
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                              notepad
                                                                                                                                                                                                                                              51⤵
                                                                                                                                                                                                                                                PID:3544
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                51⤵
                                                                                                                                                                                                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Identifies Wine through registry keys
                                                                                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                PID:3720
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                  PID:3852
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                    53⤵
                                                                                                                                                                                                                                                      PID:3920
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                        54⤵
                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:3008
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                      53⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:3928
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                        54⤵
                                                                                                                                                                                                                                                        • Sets file to hidden
                                                                                                                                                                                                                                                        PID:2224
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                      notepad
                                                                                                                                                                                                                                                      53⤵
                                                                                                                                                                                                                                                        PID:3936
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                        "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                        53⤵
                                                                                                                                                                                                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Identifies Wine through registry keys
                                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                        PID:2028
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                          54⤵
                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:3140
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                            55⤵
                                                                                                                                                                                                                                                              PID:3208
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                56⤵
                                                                                                                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                PID:3404
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                              55⤵
                                                                                                                                                                                                                                                                PID:3220
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                                                                    PID:3396
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                  notepad
                                                                                                                                                                                                                                                                  55⤵
                                                                                                                                                                                                                                                                    PID:3236
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                    "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                    55⤵
                                                                                                                                                                                                                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                    PID:3412
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                      56⤵
                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:3556
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                        57⤵
                                                                                                                                                                                                                                                                          PID:3704
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                            58⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:3868
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                          57⤵
                                                                                                                                                                                                                                                                            PID:3712
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                              58⤵
                                                                                                                                                                                                                                                                              • Sets file to hidden
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:3860
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                            notepad
                                                                                                                                                                                                                                                                            57⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:3696
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                            "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                            57⤵
                                                                                                                                                                                                                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                            PID:3892
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                              58⤵
                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                              PID:4068
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                59⤵
                                                                                                                                                                                                                                                                                  PID:3132
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                                                    • Sets file to hidden
                                                                                                                                                                                                                                                                                    PID:3348
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                  59⤵
                                                                                                                                                                                                                                                                                    PID:3148
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                      60⤵
                                                                                                                                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:3244
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                    notepad
                                                                                                                                                                                                                                                                                    59⤵
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:3152
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                    59⤵
                                                                                                                                                                                                                                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                    PID:3284
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                      60⤵
                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:3188
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                        61⤵
                                                                                                                                                                                                                                                                                          PID:3488
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                            PID:3780
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                          61⤵
                                                                                                                                                                                                                                                                                            PID:3332
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                              62⤵
                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                                                                              PID:3776
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                            notepad
                                                                                                                                                                                                                                                                                            61⤵
                                                                                                                                                                                                                                                                                              PID:3568
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                              61⤵
                                                                                                                                                                                                                                                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                                                                              • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                              PID:3800
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                62⤵
                                                                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:3984
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                  63⤵
                                                                                                                                                                                                                                                                                                    PID:3960
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                      64⤵
                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                      PID:3344
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                    63⤵
                                                                                                                                                                                                                                                                                                      PID:3772
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                        PID:3252
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                      notepad
                                                                                                                                                                                                                                                                                                      63⤵
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:4092
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                      63⤵
                                                                                                                                                                                                                                                                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                      PID:3308
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                        PID:3388
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                          65⤵
                                                                                                                                                                                                                                                                                                            PID:3452
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                              66⤵
                                                                                                                                                                                                                                                                                                              • Sets file to hidden
                                                                                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                              PID:3996
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                            65⤵
                                                                                                                                                                                                                                                                                                              PID:3676
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                66⤵
                                                                                                                                                                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                                                                                                                                                                PID:3976
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                              notepad
                                                                                                                                                                                                                                                                                                              65⤵
                                                                                                                                                                                                                                                                                                                PID:3564
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                65⤵
                                                                                                                                                                                                                                                                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                PID:3836
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                  66⤵
                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                  PID:4024
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                    67⤵
                                                                                                                                                                                                                                                                                                                      PID:3080
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                        68⤵
                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:1588
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                      67⤵
                                                                                                                                                                                                                                                                                                                        PID:2104
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                          68⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                          PID:3096
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                        notepad
                                                                                                                                                                                                                                                                                                                        67⤵
                                                                                                                                                                                                                                                                                                                          PID:316
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                          67⤵
                                                                                                                                                                                                                                                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                          • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                          PID:3300
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                            68⤵
                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                            PID:3620
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                              69⤵
                                                                                                                                                                                                                                                                                                                                PID:3776
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                                                                                                                                                    PID:3956
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                  69⤵
                                                                                                                                                                                                                                                                                                                                    PID:3808
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:3972
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                    notepad
                                                                                                                                                                                                                                                                                                                                    69⤵
                                                                                                                                                                                                                                                                                                                                      PID:3828
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                      69⤵
                                                                                                                                                                                                                                                                                                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                                      • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                      PID:4004
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                        70⤵
                                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                        PID:3820
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                          71⤵
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:3312
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                            72⤵
                                                                                                                                                                                                                                                                                                                                              PID:3612
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                            71⤵
                                                                                                                                                                                                                                                                                                                                              PID:3324
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                72⤵
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:3884
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                              notepad
                                                                                                                                                                                                                                                                                                                                              71⤵
                                                                                                                                                                                                                                                                                                                                                PID:3608
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                71⤵
                                                                                                                                                                                                                                                                                                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                                                • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                PID:2612
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                  72⤵
                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                  PID:3784
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                    73⤵
                                                                                                                                                                                                                                                                                                                                                      PID:3836
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:3408
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                      73⤵
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:2740
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                                                                                                                                                        • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                        PID:2876
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                      notepad
                                                                                                                                                                                                                                                                                                                                                      73⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3028
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                        73⤵
                                                                                                                                                                                                                                                                                                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                                                        • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                        PID:3740
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                          74⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                          PID:4076
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                            75⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:3800
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                              76⤵
                                                                                                                                                                                                                                                                                                                                                              • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                              PID:3296
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                            75⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:3304
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                              76⤵
                                                                                                                                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                              PID:1368
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                            notepad
                                                                                                                                                                                                                                                                                                                                                            75⤵
                                                                                                                                                                                                                                                                                                                                                              PID:3964
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                              75⤵
                                                                                                                                                                                                                                                                                                                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                                                                                                                                              • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                                                              • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                              PID:2052
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                76⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                PID:3616
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                  77⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:3440
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                      78⤵
                                                                                                                                                                                                                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                      PID:3472
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                    77⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:3740
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                        78⤵
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:2444
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                      notepad
                                                                                                                                                                                                                                                                                                                                                                      77⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3448
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                        77⤵
                                                                                                                                                                                                                                                                                                                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                                                                        • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                        PID:3596
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                          PID:3008
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                            79⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:3908
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                80⤵
                                                                                                                                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                PID:1324
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                              79⤵
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:780
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                80⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2560
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                notepad
                                                                                                                                                                                                                                                                                                                                                                                79⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:3560
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                  79⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                                                                                                                                                                  • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                                                                                  • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                  PID:1552
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                    80⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                    PID:3436
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                      81⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:3700
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                          82⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                          PID:2588
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                        81⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4000
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:1080
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                          notepad
                                                                                                                                                                                                                                                                                                                                                                                          81⤵
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:3252
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                          81⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                                                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                                                                                          • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                          PID:1616
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:3384
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                              83⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:3200
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3308
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                  83⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3812
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                      84⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1588
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                    notepad
                                                                                                                                                                                                                                                                                                                                                                                                    83⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3636
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    83⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                                                                                                    • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3508
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                      84⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1080
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                        85⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2748
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                            86⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3432
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                          85⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                              86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3632
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                              notepad
                                                                                                                                                                                                                                                                                                                                                                                                              85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2336
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2652
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3256
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                        87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1324
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1552
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                          87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3504
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                              88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3264
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            notepad
                                                                                                                                                                                                                                                                                                                                                                                                                            87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3988
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3368
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1404
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                      89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4124
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4316
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                        89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4144
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                            90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4336
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                            89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4152
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4324
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4468
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4732
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4552
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4724
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4568
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4748
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        138⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  139⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      140⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    139⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        139⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          139⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              140⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  141⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      142⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          142⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        141⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          141⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      143⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          144⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        143⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          143⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      146⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      145⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          145⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              146⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  147⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      148⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    147⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        148⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      147⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        147⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            148⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                149⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    149⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MR9sLp0UQRG4\MR9sLp0UQRG4\taskhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      149⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe "466202632943687079-873070812-1823054054881900855-40020431311997667-532137172"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe "16519051607729723721737526576-1919410305-1974501383965632744838177567452765983"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe "-2847476311130874974-388805174-453883244-2014510547-407660131-1492593753-400934661"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe "-614645958-2061102950658630963-796876402-1804008770-21200584044573322781592756124"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe "768160156732502611416965097-2056442363279824454-1954000563-1464604973124510573"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe "769307432909506920-2072569582-2501670641946356651535921774684026244-490262667"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe "-57135984-1519490010-90246117-171317735-1875855305-1208325931307489759-1530860577"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe "-132982441713298581201108218934-399728823567706619984956916843030618-1571218725"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe "-494438980-128897300-467374381-605519995442966485-11177079411636481669-813813339"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe "1101567220-9948074281389630780937638368-339792841-5855732961166853669-1919457585"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe "-98417126214478288041585984943-1722265920-1365908021-1748123198-804377442-46503320"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe "-1465916790-1307379193-2362075708075042191712936942-1738516454-869274773-1383988347"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe "-537190748-1585955325-1473764259-95943019513844455264223095717023218991762999672"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2588

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          993KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4424ff327fc46ccbf1e122212df6f6c0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          b1d555f699b5c1f04cf05b5a09f7c03195275b71

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          34699231be16c5d6a5e12d69fa97ae4c2e8c243894d6f22feb6d8c0686a99f0b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          91c752aa8d6e5f27f783f16c518ea41c3d3cd1d11eb610447a4b268ffa280489c51ca70ed46b4797aa5d8f8d581e98f6e97c45a62b4ac25fe9b5b7429846d9cf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/308-411-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/308-393-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/436-657-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/436-656-0x0000000004E80000-0x000000000501E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/436-761-0x0000000004E80000-0x000000000501E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/436-659-0x0000000004E80000-0x000000000501E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/436-617-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/544-551-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/544-550-0x0000000004F60000-0x00000000050FE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/576-826-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/576-811-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/816-197-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/816-180-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/952-620-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/952-605-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1068-676-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1068-812-0x0000000005290000-0x000000000542E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1068-710-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1068-711-0x0000000005290000-0x000000000542E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1416-760-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1416-904-0x0000000004F30000-0x00000000050CE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1660-354-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1660-388-0x0000000004F00000-0x000000000509E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1660-395-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1672-179-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1672-137-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1904-117-0x0000000004FC0000-0x000000000515E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1904-120-0x0000000004FC0000-0x000000000515E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1904-118-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1904-234-0x0000000004FC0000-0x000000000515E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1904-75-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1904-73-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1960-925-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1960-910-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1996-859-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1996-858-0x0000000004CF0000-0x0000000004E8E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2088-465-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2088-447-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2116-501-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2116-516-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2148-957-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2228-446-0x0000000004F60000-0x00000000050FE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2228-302-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2228-339-0x0000000004F60000-0x00000000050FE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2228-338-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2228-337-0x0000000004F60000-0x00000000050FE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2236-569-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2236-604-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2312-409-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2312-444-0x0000000003A50000-0x0000000003BEE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2312-445-0x0000000003A50000-0x0000000003BEE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2312-450-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2324-500-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2396-0-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2396-4-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2396-5-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2396-1-0x0000000000401000-0x0000000000403000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2396-16-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2396-20-0x0000000004960000-0x0000000004AFE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2396-17-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2396-18-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2452-762-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2452-135-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2452-775-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2512-56-0x0000000003CB0000-0x0000000003E4E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2512-25-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2512-8-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2512-21-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2512-24-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2512-23-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2512-10-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2512-14-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2512-6-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2512-26-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2512-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2512-15-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2512-19-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2512-53-0x0000000003CB0000-0x0000000003E4E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2512-58-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2612-357-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2612-341-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2632-908-0x0000000005050000-0x00000000051EE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2632-906-0x0000000005050000-0x00000000051EE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2632-911-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2632-873-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2636-288-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2636-304-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2644-195-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2644-232-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2692-777-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2692-909-0x0000000004E60000-0x0000000004FFE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2692-810-0x0000000004E60000-0x0000000004FFE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2692-809-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2700-553-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2700-567-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2700-59-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2700-76-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2704-45-0x0000000000190000-0x0000000000191000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2704-30-0x00000000000C0000-0x00000000000C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2856-727-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2872-874-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2888-247-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2916-675-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2916-660-0x0000000000400000-0x000000000059E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2956-391-0x0000000005030000-0x00000000051CE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2956-249-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2956-287-0x0000000005030000-0x00000000051CE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2956-285-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2956-281-0x0000000005030000-0x00000000051CE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download