Overview

overview

10

Static

static

10

ca43337b77...dd.exe

windows7-x64

10

ca43337b77...dd.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    68s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-12-2024 11:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ca43337b7757787d1b618e651b6d6d90b8244151e549a6a64ccb8ddc838565dd.exe

  • Size

    4.6MB

  • MD5

    43205894be0b600938b32d095a7d1555

  • SHA1

    a25020c4ab08ae22562e8e1f91e3e38ae9faa3f4

  • SHA256

    ca43337b7757787d1b618e651b6d6d90b8244151e549a6a64ccb8ddc838565dd

  • SHA512

    7c47524ed82703526dae42421716d4734bf07f6c866120243320ead708a970ab50fa857bed0f5d5ac5baee8aa7f4f3a67164fddd7e1a665702d8ea5a1b1a258e

  • SSDEEP

    98304:J6b+fgPSpV+apIEypgOTCqAijHZA65ALrpjiNk:JyBAONp5AijH6AAPpjp

Score
10/10
darkcometeski kamarundiscoveryevasionpersistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

eski kamarun

C2

haybensenin3.zapto.org:1604

Mutex

DC_MUTEX-4J5WTK5

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    Yf3o5TbGwnLJ

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Darkcomet family
    darkcomet
  • Modifies WinLogon for persistence 2 TTPs 48 IoCs
    persistence
  • Sets file to hidden 1 TTPs 64 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • Checks computer location settings 2 TTPs 49 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 48 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • UPX packed file 48 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies registry class 47 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\ca43337b7757787d1b618e651b6d6d90b8244151e549a6a64ccb8ddc838565dd.exe
    "C:\Users\Admin\AppData\Local\Temp\ca43337b7757787d1b618e651b6d6d90b8244151e549a6a64ccb8ddc838565dd.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2664
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\ca43337b7757787d1b618e651b6d6d90b8244151e549a6a64ccb8ddc838565dd.exe" +s +h
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1656
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp\ca43337b7757787d1b618e651b6d6d90b8244151e549a6a64ccb8ddc838565dd.exe" +s +h
        3⤵
        • Sets file to hidden
        PID:1700
    • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
      "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1636
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\737A.tmp\Mt2-Multi.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2264
        • C:\Windows\SysWOW64\xcopy.exe
          xcopy root.eix pack /y
          4⤵
          • System Location Discovery: System Language Discovery
          • Enumerates system info in registry
          PID:2308
    • C:\Windows\SysWOW64\notepad.exe
      notepad
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:632
    • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
      "C:\Windows\system32\MSDCSC\msdcsc.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2892
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4052
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
          4⤵
          • Views/modifies file attributes
          PID:3308
      • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
        "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
        3⤵
        • Executes dropped EXE
        PID:3260
      • C:\Windows\SysWOW64\notepad.exe
        notepad
        3⤵
          PID:1460
        • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\msdcsc.exe
          "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\msdcsc.exe"
          3⤵
          • Modifies WinLogon for persistence
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:4060
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
            4⤵
              PID:1680
              • C:\Windows\SysWOW64\attrib.exe
                attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                5⤵
                • Sets file to hidden
                • System Location Discovery: System Language Discovery
                • Views/modifies file attributes
                PID:4076
            • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
              "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
              4⤵
              • Executes dropped EXE
              PID:5068
            • C:\Windows\SysWOW64\notepad.exe
              notepad
              4⤵
                PID:60
              • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                4⤵
                • Modifies WinLogon for persistence
                • Checks computer location settings
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in System32 directory
                • Modifies registry class
                PID:768
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:3228
                  • C:\Windows\SysWOW64\attrib.exe
                    attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                    6⤵
                    • Sets file to hidden
                    PID:4988
                • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                  "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                  5⤵
                  • Executes dropped EXE
                  PID:3304
                • C:\Windows\SysWOW64\notepad.exe
                  notepad
                  5⤵
                    PID:1348
                  • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                    "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                    5⤵
                    • Modifies WinLogon for persistence
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Drops file in System32 directory
                    • Modifies registry class
                    PID:2436
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:2604
                      • C:\Windows\SysWOW64\attrib.exe
                        attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                        7⤵
                        • Sets file to hidden
                        • Views/modifies file attributes
                        PID:3212
                    • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                      "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                      6⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:5076
                    • C:\Windows\SysWOW64\notepad.exe
                      notepad
                      6⤵
                        PID:2720
                      • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                        "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                        6⤵
                        • Modifies WinLogon for persistence
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Drops file in System32 directory
                        • Modifies registry class
                        PID:3308
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                          7⤵
                          • System Location Discovery: System Language Discovery
                          PID:1068
                          • C:\Windows\SysWOW64\attrib.exe
                            attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                            8⤵
                            • Sets file to hidden
                            • System Location Discovery: System Language Discovery
                            • Views/modifies file attributes
                            PID:2876
                        • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                          "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                          7⤵
                          • Executes dropped EXE
                          PID:3248
                        • C:\Windows\SysWOW64\notepad.exe
                          notepad
                          7⤵
                            PID:1164
                          • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                            "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                            7⤵
                            • Modifies WinLogon for persistence
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Drops file in System32 directory
                            • Modifies registry class
                            PID:2288
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                              8⤵
                                PID:3936
                                • C:\Windows\SysWOW64\attrib.exe
                                  attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                  9⤵
                                  • Views/modifies file attributes
                                  PID:5096
                              • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                8⤵
                                • Executes dropped EXE
                                PID:1128
                              • C:\Windows\SysWOW64\notepad.exe
                                notepad
                                8⤵
                                  PID:2448
                                • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                  "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                  8⤵
                                  • Modifies WinLogon for persistence
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Drops file in System32 directory
                                  • Modifies registry class
                                  PID:1820
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                    9⤵
                                      PID:4656
                                      • C:\Windows\SysWOW64\attrib.exe
                                        attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                        10⤵
                                        • Sets file to hidden
                                        PID:1448
                                    • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                      "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                      9⤵
                                      • Executes dropped EXE
                                      PID:4996
                                    • C:\Windows\SysWOW64\notepad.exe
                                      notepad
                                      9⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:536
                                    • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                      "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                      9⤵
                                      • Modifies WinLogon for persistence
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      • Modifies registry class
                                      PID:4296
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                        10⤵
                                          PID:1140
                                          • C:\Windows\SysWOW64\attrib.exe
                                            attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                            11⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:2652
                                        • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                          "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                          10⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:3212
                                        • C:\Windows\SysWOW64\notepad.exe
                                          notepad
                                          10⤵
                                            PID:4980
                                          • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                            "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                            10⤵
                                            • Modifies WinLogon for persistence
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            • Drops file in System32 directory
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            PID:3368
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                              11⤵
                                                PID:3284
                                                • C:\Windows\SysWOW64\attrib.exe
                                                  attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                  12⤵
                                                  • Drops file in System32 directory
                                                  • System Location Discovery: System Language Discovery
                                                  • Views/modifies file attributes
                                                  PID:3744
                                              • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                11⤵
                                                • Executes dropped EXE
                                                PID:3308
                                              • C:\Windows\SysWOW64\notepad.exe
                                                notepad
                                                11⤵
                                                  PID:4568
                                                • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                  "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                  11⤵
                                                  • Modifies WinLogon for persistence
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Adds Run key to start application
                                                  • Modifies registry class
                                                  PID:2820
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                    12⤵
                                                      PID:4552
                                                      • C:\Windows\SysWOW64\attrib.exe
                                                        attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                        13⤵
                                                        • Sets file to hidden
                                                        • Views/modifies file attributes
                                                        PID:2748
                                                    • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                      "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                      12⤵
                                                      • Executes dropped EXE
                                                      PID:2520
                                                    • C:\Windows\SysWOW64\notepad.exe
                                                      notepad
                                                      12⤵
                                                        PID:4256
                                                      • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                        "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                        12⤵
                                                        • Modifies WinLogon for persistence
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Adds Run key to start application
                                                        • Drops file in System32 directory
                                                        • Modifies registry class
                                                        PID:1692
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                          13⤵
                                                            PID:3096
                                                            • C:\Windows\SysWOW64\attrib.exe
                                                              attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                              14⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2820
                                                          • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                            "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                            13⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            PID:4716
                                                          • C:\Windows\SysWOW64\notepad.exe
                                                            notepad
                                                            13⤵
                                                              PID:3180
                                                            • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                              "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                              13⤵
                                                              • Modifies WinLogon for persistence
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Adds Run key to start application
                                                              • Drops file in System32 directory
                                                              • Modifies registry class
                                                              PID:4836
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                14⤵
                                                                  PID:768
                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                    attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                    15⤵
                                                                    • Sets file to hidden
                                                                    PID:212
                                                                • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                  "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                  14⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:4000
                                                                • C:\Windows\SysWOW64\notepad.exe
                                                                  notepad
                                                                  14⤵
                                                                    PID:1692
                                                                  • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                    "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                    14⤵
                                                                    • Modifies WinLogon for persistence
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Adds Run key to start application
                                                                    • Drops file in System32 directory
                                                                    • Modifies registry class
                                                                    PID:1296
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                      15⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:5168
                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                        attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                        16⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:5244
                                                                    • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                      "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                      15⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:5204
                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                      notepad
                                                                      15⤵
                                                                        PID:5252
                                                                      • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                        "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                        15⤵
                                                                        • Modifies WinLogon for persistence
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • Adds Run key to start application
                                                                        • Drops file in System32 directory
                                                                        • Modifies registry class
                                                                        PID:5304
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                          16⤵
                                                                            PID:5460
                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                              attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                              17⤵
                                                                              • Sets file to hidden
                                                                              • Views/modifies file attributes
                                                                              PID:5532
                                                                          • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                            "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                            16⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:5496
                                                                          • C:\Windows\SysWOW64\notepad.exe
                                                                            notepad
                                                                            16⤵
                                                                              PID:5552
                                                                            • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                              "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                              16⤵
                                                                              • Modifies WinLogon for persistence
                                                                              • Checks computer location settings
                                                                              • Executes dropped EXE
                                                                              • Adds Run key to start application
                                                                              • Drops file in System32 directory
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies registry class
                                                                              PID:5596
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                17⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5656
                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                  attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                  18⤵
                                                                                  • Sets file to hidden
                                                                                  • Views/modifies file attributes
                                                                                  PID:5724
                                                                              • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                17⤵
                                                                                • Executes dropped EXE
                                                                                PID:5696
                                                                              • C:\Windows\SysWOW64\notepad.exe
                                                                                notepad
                                                                                17⤵
                                                                                  PID:5740
                                                                                • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                  "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                  17⤵
                                                                                  • Modifies WinLogon for persistence
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Adds Run key to start application
                                                                                  • Drops file in System32 directory
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Modifies registry class
                                                                                  PID:5776
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                    18⤵
                                                                                      PID:5836
                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                        attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                        19⤵
                                                                                        • Sets file to hidden
                                                                                        • Drops file in System32 directory
                                                                                        • Views/modifies file attributes
                                                                                        PID:5900
                                                                                    • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                      "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                      18⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:5852
                                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                                      notepad
                                                                                      18⤵
                                                                                        PID:5916
                                                                                      • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                        "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                        18⤵
                                                                                        • Modifies WinLogon for persistence
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        • Adds Run key to start application
                                                                                        • Drops file in System32 directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Modifies registry class
                                                                                        PID:6004
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                          19⤵
                                                                                            PID:212
                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                              attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                              20⤵
                                                                                              • Views/modifies file attributes
                                                                                              PID:5152
                                                                                          • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                            "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                            19⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:5144
                                                                                          • C:\Windows\SysWOW64\notepad.exe
                                                                                            notepad
                                                                                            19⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:5336
                                                                                          • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                            "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                            19⤵
                                                                                            • Modifies WinLogon for persistence
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Adds Run key to start application
                                                                                            • Modifies registry class
                                                                                            PID:5396
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                              20⤵
                                                                                                PID:5516
                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                  21⤵
                                                                                                    PID:5532
                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                    attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                    21⤵
                                                                                                    • Sets file to hidden
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:5432
                                                                                                • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                  20⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:5564
                                                                                                • C:\Windows\SysWOW64\notepad.exe
                                                                                                  notepad
                                                                                                  20⤵
                                                                                                    PID:5668
                                                                                                  • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                    "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                    20⤵
                                                                                                    • Modifies WinLogon for persistence
                                                                                                    • Checks computer location settings
                                                                                                    • Executes dropped EXE
                                                                                                    • Adds Run key to start application
                                                                                                    • Drops file in System32 directory
                                                                                                    • Modifies registry class
                                                                                                    PID:5848
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                      21⤵
                                                                                                        PID:3664
                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                          attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                          22⤵
                                                                                                          • Sets file to hidden
                                                                                                          PID:6132
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                        21⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:5796
                                                                                                      • C:\Windows\SysWOW64\notepad.exe
                                                                                                        notepad
                                                                                                        21⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:6096
                                                                                                      • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                        "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                        21⤵
                                                                                                        • Modifies WinLogon for persistence
                                                                                                        • Checks computer location settings
                                                                                                        • Executes dropped EXE
                                                                                                        • Adds Run key to start application
                                                                                                        • Drops file in System32 directory
                                                                                                        • Modifies registry class
                                                                                                        PID:6116
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                          22⤵
                                                                                                            PID:5304
                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                              attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                              23⤵
                                                                                                              • Drops file in System32 directory
                                                                                                              • Views/modifies file attributes
                                                                                                              PID:5948
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                            22⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:5324
                                                                                                          • C:\Windows\SysWOW64\notepad.exe
                                                                                                            notepad
                                                                                                            22⤵
                                                                                                              PID:5944
                                                                                                            • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                              "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                              22⤵
                                                                                                              • Modifies WinLogon for persistence
                                                                                                              • Checks computer location settings
                                                                                                              • Executes dropped EXE
                                                                                                              • Adds Run key to start application
                                                                                                              • Drops file in System32 directory
                                                                                                              • Modifies registry class
                                                                                                              PID:5472
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                23⤵
                                                                                                                  PID:2856
                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                    attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                    24⤵
                                                                                                                    • Views/modifies file attributes
                                                                                                                    PID:4624
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                  23⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:3668
                                                                                                                • C:\Windows\SysWOW64\notepad.exe
                                                                                                                  notepad
                                                                                                                  23⤵
                                                                                                                    PID:1060
                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                    "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                    23⤵
                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                    • Checks computer location settings
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Adds Run key to start application
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Modifies registry class
                                                                                                                    PID:5164
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                      24⤵
                                                                                                                        PID:6016
                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                          attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                          25⤵
                                                                                                                          • Sets file to hidden
                                                                                                                          • Views/modifies file attributes
                                                                                                                          PID:6104
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                        24⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:1868
                                                                                                                      • C:\Windows\SysWOW64\notepad.exe
                                                                                                                        notepad
                                                                                                                        24⤵
                                                                                                                          PID:2552
                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                          "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                          24⤵
                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                          • Checks computer location settings
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Adds Run key to start application
                                                                                                                          • Drops file in System32 directory
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Modifies registry class
                                                                                                                          PID:3608
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                            25⤵
                                                                                                                              PID:5848
                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                26⤵
                                                                                                                                • Views/modifies file attributes
                                                                                                                                PID:5472
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                              25⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:5232
                                                                                                                            • C:\Windows\SysWOW64\notepad.exe
                                                                                                                              notepad
                                                                                                                              25⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:6216
                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                              "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                              25⤵
                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                              • Checks computer location settings
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Adds Run key to start application
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Modifies registry class
                                                                                                                              PID:6256
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                26⤵
                                                                                                                                  PID:6304
                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                    attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                    27⤵
                                                                                                                                    • Sets file to hidden
                                                                                                                                    • Views/modifies file attributes
                                                                                                                                    PID:6372
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                  26⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:6340
                                                                                                                                • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                  notepad
                                                                                                                                  26⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:6396
                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                  "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                  26⤵
                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                  • Checks computer location settings
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Adds Run key to start application
                                                                                                                                  • Modifies registry class
                                                                                                                                  PID:6440
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                    27⤵
                                                                                                                                      PID:6488
                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                        attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                        28⤵
                                                                                                                                        • Sets file to hidden
                                                                                                                                        • Views/modifies file attributes
                                                                                                                                        PID:6552
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                      27⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:6524
                                                                                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                      notepad
                                                                                                                                      27⤵
                                                                                                                                        PID:6576
                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 6576 -s 96
                                                                                                                                          28⤵
                                                                                                                                          • Program crash
                                                                                                                                          PID:6680
                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                        "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                        27⤵
                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                        • Checks computer location settings
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Adds Run key to start application
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        • Modifies registry class
                                                                                                                                        PID:6688
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                          28⤵
                                                                                                                                            PID:6748
                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                              attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                              29⤵
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              • Views/modifies file attributes
                                                                                                                                              PID:6808
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                            28⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:6784
                                                                                                                                          • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                            notepad
                                                                                                                                            28⤵
                                                                                                                                              PID:6868
                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                              "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                              28⤵
                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                              • Checks computer location settings
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Adds Run key to start application
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              • Modifies registry class
                                                                                                                                              PID:6916
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                29⤵
                                                                                                                                                  PID:6964
                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                    attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                    30⤵
                                                                                                                                                      PID:7020
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                    29⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:7012
                                                                                                                                                  • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                    notepad
                                                                                                                                                    29⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:7044
                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                    "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                    29⤵
                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                    • Checks computer location settings
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                    • Modifies registry class
                                                                                                                                                    PID:7080
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                      30⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:7140
                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                        attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                        31⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                        PID:6056
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                      30⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:2168
                                                                                                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                      notepad
                                                                                                                                                      30⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:3112
                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                      "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                      30⤵
                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                      • Checks computer location settings
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      PID:6156
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                        31⤵
                                                                                                                                                          PID:6200
                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                            attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                            32⤵
                                                                                                                                                            • Sets file to hidden
                                                                                                                                                            PID:6316
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                          31⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:5320
                                                                                                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                          notepad
                                                                                                                                                          31⤵
                                                                                                                                                            PID:6372
                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                            "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                            31⤵
                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                            • Checks computer location settings
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            • Modifies registry class
                                                                                                                                                            PID:6260
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                              32⤵
                                                                                                                                                                PID:6388
                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                  33⤵
                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                  PID:6464
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                32⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:6640
                                                                                                                                                              • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                notepad
                                                                                                                                                                32⤵
                                                                                                                                                                  PID:6484
                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                  "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                  32⤵
                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                  PID:6808
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                    33⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:6844
                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                      34⤵
                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                      PID:6700
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                    33⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:6644
                                                                                                                                                                  • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                    notepad
                                                                                                                                                                    33⤵
                                                                                                                                                                      PID:6688
                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                      "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                      33⤵
                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                      PID:6948
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                        34⤵
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:7152
                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          35⤵
                                                                                                                                                                            PID:6056
                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                            35⤵
                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                            PID:7084
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                          34⤵
                                                                                                                                                                            PID:5988
                                                                                                                                                                          • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                            notepad
                                                                                                                                                                            34⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:7088
                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                            "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                            34⤵
                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                            PID:5784
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                              35⤵
                                                                                                                                                                                PID:6192
                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                  36⤵
                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                  PID:6456
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                35⤵
                                                                                                                                                                                  PID:6464
                                                                                                                                                                                • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                  notepad
                                                                                                                                                                                  35⤵
                                                                                                                                                                                    PID:6564
                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                    "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                    35⤵
                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                    PID:6700
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                      36⤵
                                                                                                                                                                                        PID:5992
                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                          37⤵
                                                                                                                                                                                            PID:6808
                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                            37⤵
                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                            PID:6936
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                          36⤵
                                                                                                                                                                                            PID:7124
                                                                                                                                                                                          • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                            notepad
                                                                                                                                                                                            36⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:7092
                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                            36⤵
                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                            PID:6188
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                              37⤵
                                                                                                                                                                                                PID:5784
                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                  38⤵
                                                                                                                                                                                                    PID:6916
                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                    38⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                    PID:6480
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                  37⤵
                                                                                                                                                                                                    PID:6680
                                                                                                                                                                                                  • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                    notepad
                                                                                                                                                                                                    37⤵
                                                                                                                                                                                                      PID:3728
                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 192
                                                                                                                                                                                                        38⤵
                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                        PID:7192
                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                      37⤵
                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                      PID:7212
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                        38⤵
                                                                                                                                                                                                          PID:7272
                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                            39⤵
                                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                            PID:7336
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                          38⤵
                                                                                                                                                                                                            PID:7312
                                                                                                                                                                                                          • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                            notepad
                                                                                                                                                                                                            38⤵
                                                                                                                                                                                                              PID:7356
                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                              38⤵
                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                              PID:7392
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                39⤵
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:7448
                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                  40⤵
                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                  PID:7512
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                39⤵
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:7488
                                                                                                                                                                                                              • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                notepad
                                                                                                                                                                                                                39⤵
                                                                                                                                                                                                                  PID:7532
                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                  39⤵
                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                  PID:7568
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                    40⤵
                                                                                                                                                                                                                      PID:7616
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                        41⤵
                                                                                                                                                                                                                        • Sets file to hidden
                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                        PID:7676
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                      40⤵
                                                                                                                                                                                                                        PID:7652
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                        notepad
                                                                                                                                                                                                                        40⤵
                                                                                                                                                                                                                          PID:7708
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                          40⤵
                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                          PID:7744
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                            41⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:7792
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                              42⤵
                                                                                                                                                                                                                              • Sets file to hidden
                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:7852
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                            41⤵
                                                                                                                                                                                                                              PID:7828
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                              notepad
                                                                                                                                                                                                                              41⤵
                                                                                                                                                                                                                                PID:7872
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                41⤵
                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                PID:7908
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                  42⤵
                                                                                                                                                                                                                                    PID:7968
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                      43⤵
                                                                                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                      PID:8028
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                    42⤵
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:8004
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                    notepad
                                                                                                                                                                                                                                    42⤵
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:8048
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                    "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                    42⤵
                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                    PID:8092
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                      43⤵
                                                                                                                                                                                                                                        PID:8140
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                                                                                          PID:6700
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                        43⤵
                                                                                                                                                                                                                                          PID:8176
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                          notepad
                                                                                                                                                                                                                                          43⤵
                                                                                                                                                                                                                                            PID:7200
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                            43⤵
                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                            PID:7368
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                              44⤵
                                                                                                                                                                                                                                                PID:7212
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                  45⤵
                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                  PID:7396
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                44⤵
                                                                                                                                                                                                                                                  PID:7544
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                  notepad
                                                                                                                                                                                                                                                  44⤵
                                                                                                                                                                                                                                                    PID:7484
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                    "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                    44⤵
                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                    PID:7720
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                      45⤵
                                                                                                                                                                                                                                                        PID:7692
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                          46⤵
                                                                                                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                          PID:7780
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                        45⤵
                                                                                                                                                                                                                                                          PID:5892
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                          notepad
                                                                                                                                                                                                                                                          45⤵
                                                                                                                                                                                                                                                            PID:4016
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                            45⤵
                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                            PID:1476
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                              46⤵
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:7948
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                47⤵
                                                                                                                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                PID:7236
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                              46⤵
                                                                                                                                                                                                                                                                PID:8152
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                notepad
                                                                                                                                                                                                                                                                46⤵
                                                                                                                                                                                                                                                                  PID:6188
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                  46⤵
                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                  PID:8096
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                    47⤵
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:7428
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                                                                                                                      PID:7228
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                    47⤵
                                                                                                                                                                                                                                                                      PID:4628
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                      notepad
                                                                                                                                                                                                                                                                      47⤵
                                                                                                                                                                                                                                                                        PID:7248
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                        47⤵
                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                        PID:7744
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                          48⤵
                                                                                                                                                                                                                                                                            PID:7596
                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                              49⤵
                                                                                                                                                                                                                                                                                PID:7720
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                49⤵
                                                                                                                                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                                PID:7936
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                              48⤵
                                                                                                                                                                                                                                                                                PID:6196
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                notepad
                                                                                                                                                                                                                                                                                48⤵
                                                                                                                                                                                                                                                                                  PID:1200
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                  48⤵
                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                  PID:7228
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                    49⤵
                                                                                                                                                                                                                                                                                      PID:8132
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                        50⤵
                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                        PID:4836
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                      49⤵
                                                                                                                                                                                                                                                                                        PID:7908
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                        notepad
                                                                                                                                                                                                                                                                                        49⤵
                                                                                                                                                                                                                                                                                          PID:5088
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                          49⤵
                                                                                                                                                                                                                                                                                            PID:7920
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                              50⤵
                                                                                                                                                                                                                                                                                                PID:5904
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                  51⤵
                                                                                                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                  PID:7804
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                50⤵
                                                                                                                                                                                                                                                                                                  PID:7224
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                  notepad
                                                                                                                                                                                                                                                                                                  50⤵
                                                                                                                                                                                                                                                                                                    PID:3296
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                    50⤵
                                                                                                                                                                                                                                                                                                      PID:2892
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                        51⤵
                                                                                                                                                                                                                                                                                                          PID:4836
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                            52⤵
                                                                                                                                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                            PID:8208
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                          51⤵
                                                                                                                                                                                                                                                                                                            PID:2868
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                            notepad
                                                                                                                                                                                                                                                                                                            51⤵
                                                                                                                                                                                                                                                                                                              PID:8236
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                              51⤵
                                                                                                                                                                                                                                                                                                                PID:8272
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                                                                                                                                    PID:8324
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                      53⤵
                                                                                                                                                                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                      PID:8384
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                    52⤵
                                                                                                                                                                                                                                                                                                                      PID:8360
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                      notepad
                                                                                                                                                                                                                                                                                                                      52⤵
                                                                                                                                                                                                                                                                                                                        PID:8400
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                        52⤵
                                                                                                                                                                                                                                                                                                                          PID:8444
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                            53⤵
                                                                                                                                                                                                                                                                                                                              PID:8496
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                PID:8556
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                              53⤵
                                                                                                                                                                                                                                                                                                                                PID:8532
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                notepad
                                                                                                                                                                                                                                                                                                                                53⤵
                                                                                                                                                                                                                                                                                                                                  PID:8588
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                  53⤵
                                                                                                                                                                                                                                                                                                                                    PID:8628
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                                                                                                                        PID:8676
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                          55⤵
                                                                                                                                                                                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                          PID:8728
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                        54⤵
                                                                                                                                                                                                                                                                                                                                          PID:8720
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                          notepad
                                                                                                                                                                                                                                                                                                                                          54⤵
                                                                                                                                                                                                                                                                                                                                            PID:8772
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                            54⤵
                                                                                                                                                                                                                                                                                                                                              PID:8808
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                55⤵
                                                                                                                                                                                                                                                                                                                                                  PID:8856
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                    PID:8916
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                  55⤵
                                                                                                                                                                                                                                                                                                                                                    PID:8884
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                    notepad
                                                                                                                                                                                                                                                                                                                                                    55⤵
                                                                                                                                                                                                                                                                                                                                                      PID:8952
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                      55⤵
                                                                                                                                                                                                                                                                                                                                                        PID:8988
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                          56⤵
                                                                                                                                                                                                                                                                                                                                                            PID:9036
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                              57⤵
                                                                                                                                                                                                                                                                                                                                                              • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                              PID:9100
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                            56⤵
                                                                                                                                                                                                                                                                                                                                                              PID:9076
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                              notepad
                                                                                                                                                                                                                                                                                                                                                              56⤵
                                                                                                                                                                                                                                                                                                                                                                PID:9124
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                56⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:9164
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                    57⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:8212
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                        PID:4820
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                      57⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:7432
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                        notepad
                                                                                                                                                                                                                                                                                                                                                                        57⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1088
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                          57⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:1664
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                              58⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:8320
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                  59⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                  PID:1008
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                58⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:8556
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                  notepad
                                                                                                                                                                                                                                                                                                                                                                                  58⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3320
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                    58⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:8480
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                        59⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:6548
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                            60⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:3184
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                            59⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1520
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                              notepad
                                                                                                                                                                                                                                                                                                                                                                                              59⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:6804
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                59⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:8672
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6884
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                        61⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                        60⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:8836
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                          notepad
                                                                                                                                                                                                                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            60⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:8944
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                    62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8224
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                  61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9032
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    notepad
                                                                                                                                                                                                                                                                                                                                                                                                                    61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1464
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8388
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                          62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8296
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                              63⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3016
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1156
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              notepad
                                                                                                                                                                                                                                                                                                                                                                                                                              62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3632
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8316
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                    63⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3204
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2384
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                      63⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3984
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                        63⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4480
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          63⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3088
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                              64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8636
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                  65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9012
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2052
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                  64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1404
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                        65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9172
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                            65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9208
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        83⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              83⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                83⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  83⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    83⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 11184 -s 416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MSDCSC\Yf3o5TbGwnLJ\Yf3o5TbGwnLJ\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        notepad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6576 -ip 6576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3728 -ip 3728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 11184 -ip 11184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11208

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\737A.tmp\Mt2-Multi.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1017B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        e8418b1de6056eba9bc6ab0c39816d92

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        84f1a312e1e091a6a3a2732dfaadb184925ecf23

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        dc03a6cb5d890b394710e7e7e62078769e022f67fc860ef395c9266cc6e366c3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5850e9ae599d8e331cd1de9d588b6141a5fb49535465269e77f48f5f8c502e8031bc8db323c24ea8d4848fc65504ae1fbd6fde668ed14ae1f5671efccdc8215b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MT2-MULTI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ccc17e89b056812ed0974d656b1238af

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3cb7818b697a97a51765849dfdc1d907a53e3b46

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5665f6c603b8356a61fe90d5d90b0ea945342c90210eccdf4884d1ca88013703

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        67c327330ea33026e447c3b636c86833145e2b9931b423cfa906c4d0423504e7d374f389cb3c1b31cc98e3f235b9e0e14d633b0b7df1f0135b5df71187510601

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\locale_de.eix
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ecd47ce38514bdcc77261d7999c1fc31

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2474132673bff0597126066a02aacf93d121df33

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7de3ed1684a75828b8b018b657377526d3757ec12c3bae23b791397d99725177

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        f444739eba131ead9fb3758866c695da3e9b71fcd17f9a9b6f17a8385eadb2d9c5b525048c2ec79792e6524f2620c73151fc49956335b684756f3dec8e97d800

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\locale_de.epk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        d7f078c90867fcde7c5d8436cc56971c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        b1f71f7496418a479ceaf584d010b5c33dd8974e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        90e38a646c07e5ea8456459bee2d07920e48bd916e841f8328372d2971a74c98

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2b44e4e583c8d6205d1e5532c50d2811bc704455ba89312746084a2a3d5e688c7a12c3fcd5c2031abb6a84a2eb9f8406f1096f1236bcc1496bde07365dbaba13

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mod_config.cfg
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        105B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        f856c5b043e95b51974550405aef95af

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        e7e8b5e0000fdb416a46c3d95316520e92c5185e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        b1bb1ad59ab40011980401ad514b4e7a2adcba56912045afbad090f593fce813

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        e38a84fd7baef517a9cf031c69ce63cb4136de2ec2cf8665d24b9632faf5fed523b73754225c6cce92967ea378f85d21c21e0735dc070891f1a52a57f769927f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mod_config.cfg
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        105B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ca14ecc83de3fc819678245775548447

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ccf63837648c639ab531d1939f10a56f1a02a498

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5d8e12768200fe57db3351a1fe410d9bd4b7e900539f607aff462791819cf4c6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        37fd69bc75ae94fbeb2efc6dcae7a40a36125a4c62fb0f0d0fc4fb871a0170b41bd7649ea0a865e42861f6915e928fd133b06e965417b20313bbe1ccef5047f2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\root.eix
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        bd2a5779cc56ea237fcf3190e3a0c0e8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3b017ae3f3e64754f99ab3803560aa154f03d5d6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        e1be3b513f11f6745da58ca609704591658510dfb58a42fc660f86dae68a4992

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ee664522f20f364d2d99ebeaedc639d156f96d1674fe0ae20c4b817b0043de471caf5d69ec7a7711aa81e7e1e9237de168f3a45e734f44ca74ce84cdc9fbc65a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\root.epk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        476KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5792c65c1dc2c5c657004d31e530ca23

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        93331ecf3b01f8c8db7848a6dceb34ad963f6e9a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4f7a1780891327a85b41a7e0e1375b7361540b103a09f9e225365d2af8b4e31c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        bf66bc9be105cd8a19ae7ea33a1e86ff40b94b04087dfc59ed0fefedbc8f646625fc09b6516edf39c1023b6c30c04c5c24a61d3457e6d2192caaa4fc23dc112d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\set.cfg
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        8B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        cf106c160ab2015290153cf1ac9b136a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        69fa99e80963719ca20291a12cd0b3b740069ebc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        441a3573c8ad169ee54e4fec296b5fedca650b4193e130dfece3da9ab9e072e8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        839049eb6f9759dca9b9bfca061ce3c15024d4809514f2ec139fcfbc20d5ac3f7050196504828821fc3d68ec0562df3db390e589eee80d293511768c31f54fff

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        43205894be0b600938b32d095a7d1555

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        a25020c4ab08ae22562e8e1f91e3e38ae9faa3f4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ca43337b7757787d1b618e651b6d6d90b8244151e549a6a64ccb8ddc838565dd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7c47524ed82703526dae42421716d4734bf07f6c866120243320ead708a970ab50fa857bed0f5d5ac5baee8aa7f4f3a67164fddd7e1a665702d8ea5a1b1a258e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/632-12-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/768-247-0x0000000000400000-0x00000000008A9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1128-265-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1128-325-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1128-403-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1296-348-0x0000000000400000-0x00000000008A9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1636-257-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1636-11-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1692-330-0x0000000000400000-0x00000000008A9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1820-284-0x0000000000400000-0x00000000008A9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2288-270-0x0000000000400000-0x00000000008A9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2436-256-0x0000000000400000-0x00000000008A9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2520-378-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2520-303-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2664-110-0x0000000000400000-0x00000000008A9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2664-0-0x00000000027E0000-0x00000000027E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2820-307-0x0000000000400000-0x00000000008A9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2892-176-0x0000000000400000-0x00000000008A9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3212-287-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3212-423-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3212-342-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3248-302-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3248-385-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3260-346-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3260-421-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3260-282-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3260-264-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3304-286-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3304-458-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3304-377-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3308-295-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3308-368-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3308-262-0x0000000000400000-0x00000000008A9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3368-299-0x0000000000400000-0x00000000008A9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4000-335-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4000-410-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4060-241-0x0000000000400000-0x00000000008A9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4296-291-0x0000000000400000-0x00000000008A9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4716-384-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4836-340-0x0000000000400000-0x00000000008A9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4996-273-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4996-416-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4996-334-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5068-428-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5068-366-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5068-272-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5068-181-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5076-383-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5076-294-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5144-412-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5144-471-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5204-417-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5204-343-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5304-376-0x0000000000400000-0x00000000008A9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5324-538-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5396-422-0x0000000000400000-0x00000000008A9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5496-371-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5496-424-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5564-418-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5564-515-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5596-382-0x0000000000400000-0x00000000008A9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5696-460-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5696-379-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5776-388-0x0000000000400000-0x00000000008A9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5796-425-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5796-524-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5848-429-0x0000000000400000-0x00000000008A9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5852-465-0x0000000000400000-0x00000000008C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/6004-415-0x0000000000400000-0x00000000008A9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download