e877429d2afff2977497e4c9c379b2c6a140143d7df19478344871e05be8ad6c

Analysis

max time kernel
40s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/05/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eDEX-UI-Windows-x64.exe
Size 67.3MB
Sample260502-werwsac121
SHA256 e877429d2afff2977497e4c9c379b2c6a140143d7df19478344871e05be8ad6c
MD5 20beff9c4cc991a27dbc24e61067f37f
SHA1 0c65ad7d5f4a58be8533aca3e1477fadbc41c663
SHA512 ac68cff0b7d772a57bba95efafe52073c6910495ebf0a0889e9306bb460b4d5c916c18906af13c6a655bfcee53478a23721f59d698614c30911dae455cfe697d
SSDEEP 1572864:sUsupvKvEGsVn6879Q0Pmuj1nUBw4rz/oygN6GPdxCCPDlCw:sRupveEP68h1z5UBw4rzAxPdphCw
TLSH
T138F733347886C3ECE98D0FB1AABC498B4709E995801431E54BFD75CD7738CB2AA1E54E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
2268	eDEX-UI.exe
2804	eDEX-UI.exe
5536	eDEX-UI.exe
2132	eDEX-UI.exe
5464	eDEX-UI.exe
5612	eDEX-UI.exe
3196	eDEX-UI.exe
4324	eDEX-UI.exe
3436	eDEX-UI.exe
3236	eDEX-UI.exe
3996	eDEX-UI.exe
5260	eDEX-UI.exe

Loads dropped DLL 27 IoCs

pid	Process
3388	eDEX-UI-Windows-x64.exe
3388	eDEX-UI-Windows-x64.exe
3388	eDEX-UI-Windows-x64.exe
3388	eDEX-UI-Windows-x64.exe
3388	eDEX-UI-Windows-x64.exe
3388	eDEX-UI-Windows-x64.exe
3388	eDEX-UI-Windows-x64.exe
3388	eDEX-UI-Windows-x64.exe
3388	eDEX-UI-Windows-x64.exe
3388	eDEX-UI-Windows-x64.exe
3388	eDEX-UI-Windows-x64.exe
2268	eDEX-UI.exe
2804	eDEX-UI.exe
2804	eDEX-UI.exe
2804	eDEX-UI.exe
2804	eDEX-UI.exe
5536	eDEX-UI.exe
2268	eDEX-UI.exe
2132	eDEX-UI.exe
5464	eDEX-UI.exe
5612	eDEX-UI.exe
3196	eDEX-UI.exe
4324	eDEX-UI.exe
3436	eDEX-UI.exe
3236	eDEX-UI.exe
3996	eDEX-UI.exe
5260	eDEX-UI.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 10 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
11	raw.githubusercontent.com
12	raw.githubusercontent.com
15	raw.githubusercontent.com
16	raw.githubusercontent.com
7	raw.githubusercontent.com
9	raw.githubusercontent.com
10	raw.githubusercontent.com
13	raw.githubusercontent.com
17	raw.githubusercontent.com

Looks up external IP address via web service 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
32	myexternalip.com
34	myexternalip.com
36	myexternalip.com
49	myexternalip.com
61	myexternalip.com
73	myexternalip.com
7	myexternalip.com
19	myexternalip.com

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6444	powershell.exe
7380	powershell.exe
5576	powershell.exe
7080	powershell.exe
7072	powershell.exe
6580	powershell.exe
7828	powershell.exe
6956	Process not Found
2776	powershell.exe
8172	powershell.exe
7100	powershell.exe
8368	Process not Found
6300	powershell.exe
7448	powershell.exe
8952	powershell.exe
7000	Process not Found
6152	Process not Found
772	powershell.exe
7000	powershell.exe
1156	powershell.exe
7656	powershell.exe
7648	powershell.exe
6572	powershell.exe
6756	powershell.exe
7036	powershell.exe
6332	Process not Found
6080	powershell.exe
7464	powershell.exe
5864	powershell.exe
6308	powershell.exe
8196	powershell.exe
8588	powershell.exe
2512	Process not Found
2480	powershell.exe
3692	powershell.exe
3272	powershell.exe
3320	powershell.exe
6940	powershell.exe
2236	powershell.exe
9196	powershell.exe
6900	powershell.exe
8500	Process not Found
1664	powershell.exe
6756	powershell.exe
4256	powershell.exe
8132	powershell.exe
7380	powershell.exe
6900	powershell.exe
6292	powershell.exe
6164	Process not Found
6356	Process not Found
2076	Process not Found
6188	powershell.exe
1420	powershell.exe
8744	powershell.exe
7084	powershell.exe
4292	powershell.exe
8180	Process not Found
6488	Process not Found
536	powershell.exe
8504	powershell.exe
6504	powershell.exe
6344	powershell.exe
1188	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eDEX-UI-Windows-x64.exe

Checks processor information in registry 2 TTPs 50 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	eDEX-UI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	eDEX-UI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	eDEX-UI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	eDEX-UI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	eDEX-UI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	eDEX-UI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	eDEX-UI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	eDEX-UI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	eDEX-UI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	eDEX-UI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	eDEX-UI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	eDEX-UI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	eDEX-UI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	eDEX-UI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	eDEX-UI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	eDEX-UI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	eDEX-UI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	eDEX-UI.exe

Collects information from the system 1 TTPs 2 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
5460	WMIC.exe
1924	WMIC.exe

Gathers network information 2 TTPs 64 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
996	ipconfig.exe
7748	ipconfig.exe
1924	Process not Found
1508	ipconfig.exe
4772	ipconfig.exe
3824	ipconfig.exe
5888	Process not Found
4588	NETSTAT.EXE
7032	NETSTAT.EXE
7528	ipconfig.exe
6908	NETSTAT.EXE
5932	NETSTAT.EXE
7236	ipconfig.exe
7876	NETSTAT.EXE
4432	NETSTAT.EXE
6860	ipconfig.exe
588	NETSTAT.EXE
8884	NETSTAT.EXE
7124	Process not Found
1864	ipconfig.exe
8704	NETSTAT.EXE
1060	ipconfig.exe
4200	Process not Found
3848	ipconfig.exe
708	NETSTAT.EXE
6996	ipconfig.exe
8836	NETSTAT.EXE
7668	ipconfig.exe
6364	NETSTAT.EXE
1868	Process not Found
220	Process not Found
6120	ipconfig.exe
8408	NETSTAT.EXE
5524	NETSTAT.EXE
7588	ipconfig.exe
4404	NETSTAT.EXE
3672	ipconfig.exe
7304	ipconfig.exe
5696	Process not Found
8344	ipconfig.exe
8656	NETSTAT.EXE
1788	ipconfig.exe
4148	NETSTAT.EXE
1356	ipconfig.exe
5016	NETSTAT.EXE
8420	NETSTAT.EXE
7780	ipconfig.exe
6636	ipconfig.exe
6644	ipconfig.exe
7400	NETSTAT.EXE
3084	NETSTAT.EXE
6240	ipconfig.exe
6432	ipconfig.exe
7772	NETSTAT.EXE
8068	NETSTAT.EXE
6784	NETSTAT.EXE
1228	ipconfig.exe
8092	ipconfig.exe
7580	ipconfig.exe
5040	NETSTAT.EXE
6376	Process not Found
2972	ipconfig.exe
8916	ipconfig.exe
8368	NETSTAT.EXE

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
3388	eDEX-UI-Windows-x64.exe
3388	eDEX-UI-Windows-x64.exe
3388	eDEX-UI-Windows-x64.exe
3388	eDEX-UI-Windows-x64.exe
3388	eDEX-UI-Windows-x64.exe
3388	eDEX-UI-Windows-x64.exe
5536	eDEX-UI.exe
5536	eDEX-UI.exe
2644	powershell.exe
2132	eDEX-UI.exe
2132	eDEX-UI.exe
5464	eDEX-UI.exe
5464	eDEX-UI.exe
5612	eDEX-UI.exe
5612	eDEX-UI.exe
3196	eDEX-UI.exe
3196	eDEX-UI.exe
3996	eDEX-UI.exe
3996	eDEX-UI.exe
4324	eDEX-UI.exe
4324	eDEX-UI.exe
3436	eDEX-UI.exe
3436	eDEX-UI.exe
3236	eDEX-UI.exe
3236	eDEX-UI.exe
2268	eDEX-UI.exe
2268	eDEX-UI.exe
2268	eDEX-UI.exe
2268	eDEX-UI.exe
2268	eDEX-UI.exe
2268	eDEX-UI.exe
2268	eDEX-UI.exe
2268	eDEX-UI.exe
2644	powershell.exe
2644	powershell.exe
3996	eDEX-UI.exe
3996	eDEX-UI.exe
6080	powershell.exe
6080	powershell.exe
1772	powershell.exe
1772	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3388	eDEX-UI-Windows-x64.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	6080	powershell.exe
Token: SeDebugPrivilege	1772	powershell.exe
Token: SeIncreaseQuotaPrivilege	4380	WMIC.exe
Token: SeSecurityPrivilege	4380	WMIC.exe
Token: SeTakeOwnershipPrivilege	4380	WMIC.exe
Token: SeLoadDriverPrivilege	4380	WMIC.exe
Token: SeSystemProfilePrivilege	4380	WMIC.exe
Token: SeSystemtimePrivilege	4380	WMIC.exe
Token: SeProfSingleProcessPrivilege	4380	WMIC.exe
Token: SeIncBasePriorityPrivilege	4380	WMIC.exe
Token: SeCreatePagefilePrivilege	4380	WMIC.exe
Token: SeBackupPrivilege	4380	WMIC.exe
Token: SeRestorePrivilege	4380	WMIC.exe
Token: SeShutdownPrivilege	4380	WMIC.exe
Token: SeDebugPrivilege	4380	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4380	WMIC.exe
Token: SeRemoteShutdownPrivilege	4380	WMIC.exe
Token: SeUndockPrivilege	4380	WMIC.exe
Token: SeManageVolumePrivilege	4380	WMIC.exe
Token: 33	4380	WMIC.exe
Token: 34	4380	WMIC.exe
Token: 35	4380	WMIC.exe
Token: 36	4380	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6004	WMIC.exe
Token: SeSecurityPrivilege	6004	WMIC.exe
Token: SeTakeOwnershipPrivilege	6004	WMIC.exe
Token: SeLoadDriverPrivilege	6004	WMIC.exe
Token: SeSystemProfilePrivilege	6004	WMIC.exe
Token: SeSystemtimePrivilege	6004	WMIC.exe
Token: SeProfSingleProcessPrivilege	6004	WMIC.exe
Token: SeIncBasePriorityPrivilege	6004	WMIC.exe
Token: SeCreatePagefilePrivilege	6004	WMIC.exe
Token: SeBackupPrivilege	6004	WMIC.exe
Token: SeRestorePrivilege	6004	WMIC.exe
Token: SeShutdownPrivilege	6004	WMIC.exe
Token: SeDebugPrivilege	6004	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6004	WMIC.exe
Token: SeRemoteShutdownPrivilege	6004	WMIC.exe
Token: SeUndockPrivilege	6004	WMIC.exe
Token: SeManageVolumePrivilege	6004	WMIC.exe
Token: 33	6004	WMIC.exe
Token: 34	6004	WMIC.exe
Token: 35	6004	WMIC.exe
Token: 36	6004	WMIC.exe
Token: SeIncreaseQuotaPrivilege	748	WMIC.exe
Token: SeSecurityPrivilege	748	WMIC.exe
Token: SeTakeOwnershipPrivilege	748	WMIC.exe
Token: SeLoadDriverPrivilege	748	WMIC.exe
Token: SeSystemProfilePrivilege	748	WMIC.exe
Token: SeSystemtimePrivilege	748	WMIC.exe
Token: SeProfSingleProcessPrivilege	748	WMIC.exe
Token: SeIncBasePriorityPrivilege	748	WMIC.exe
Token: SeCreatePagefilePrivilege	748	WMIC.exe
Token: SeBackupPrivilege	748	WMIC.exe
Token: SeRestorePrivilege	748	WMIC.exe
Token: SeShutdownPrivilege	748	WMIC.exe
Token: SeDebugPrivilege	748	WMIC.exe
Token: SeSystemEnvironmentPrivilege	748	WMIC.exe
Token: SeRemoteShutdownPrivilege	748	WMIC.exe
Token: SeUndockPrivilege	748	WMIC.exe
Token: SeManageVolumePrivilege	748	WMIC.exe
Token: 33	748	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2268	eDEX-UI.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2804	2268	eDEX-UI.exe	81
PID 2268 wrote to memory of 5536	2268	eDEX-UI.exe	82
PID 2268 wrote to memory of 1076	2268	eDEX-UI.exe	84
PID 2268 wrote to memory of 2644	2268	eDEX-UI.exe	85
PID 2268 wrote to memory of 3148	2268	eDEX-UI.exe	86
PID 3148 wrote to memory of 6000	3148	cmd.exe	88
PID 2268 wrote to memory of 2132	2268	eDEX-UI.exe	89
PID 2268 wrote to memory of 5464	2268	eDEX-UI.exe	90
PID 2268 wrote to memory of 5612	2268	eDEX-UI.exe	91
PID 2268 wrote to memory of 3196	2268	eDEX-UI.exe	92
PID 2268 wrote to memory of 4324	2268	eDEX-UI.exe	93
PID 2268 wrote to memory of 3436	2268	eDEX-UI.exe	94
PID 2268 wrote to memory of 3236	2268	eDEX-UI.exe	95
PID 2268 wrote to memory of 3996	2268	eDEX-UI.exe	96
PID 5464 wrote to memory of 6020	5464	eDEX-UI.exe	97
PID 2132 wrote to memory of 6104	2132	eDEX-UI.exe	98
PID 5612 wrote to memory of 488	5612	eDEX-UI.exe	100
PID 3196 wrote to memory of 5096	3196	eDEX-UI.exe	103
PID 4324 wrote to memory of 4792	4324	eDEX-UI.exe	104
PID 3236 wrote to memory of 3064	3236	eDEX-UI.exe	107
PID 3436 wrote to memory of 1904	3436	eDEX-UI.exe	108
PID 6020 wrote to memory of 1836	6020	cmd.exe	111
PID 488 wrote to memory of 2080	488	cmd.exe	112
PID 6104 wrote to memory of 1484	6104	cmd.exe	113
PID 5096 wrote to memory of 6044	5096	cmd.exe	114
PID 4792 wrote to memory of 3536	4792	cmd.exe	115
PID 3064 wrote to memory of 1452	3064	cmd.exe	116
PID 1904 wrote to memory of 5272	1904	cmd.exe	117
PID 2268 wrote to memory of 5260	2268	eDEX-UI.exe	118
PID 5612 wrote to memory of 784	5612	eDEX-UI.exe	119
PID 3436 wrote to memory of 2404	3436	eDEX-UI.exe	123
PID 5464 wrote to memory of 1088	5464	eDEX-UI.exe	120
PID 5464 wrote to memory of 1772	5464	eDEX-UI.exe	125
PID 3196 wrote to memory of 572	3196	eDEX-UI.exe	121
PID 4324 wrote to memory of 2272	4324	eDEX-UI.exe	122
PID 5464 wrote to memory of 6080	5464	eDEX-UI.exe	126
PID 3236 wrote to memory of 5360	3236	eDEX-UI.exe	129
PID 572 wrote to memory of 424	572	cmd.exe	312
PID 2272 wrote to memory of 6132	2272	cmd.exe	137
PID 1088 wrote to memory of 1256	1088	cmd.exe	136
PID 1088 wrote to memory of 6004	1088	cmd.exe	300
PID 784 wrote to memory of 1340	784	cmd.exe	139
PID 2272 wrote to memory of 4380	2272	cmd.exe	140
PID 2404 wrote to memory of 836	2404	cmd.exe	319
PID 784 wrote to memory of 748	784	cmd.exe	141
PID 5360 wrote to memory of 5408	5360	cmd.exe	737
PID 2404 wrote to memory of 5212	2404	cmd.exe	144
PID 3196 wrote to memory of 5004	3196	eDEX-UI.exe	145
PID 3196 wrote to memory of 4532	3196	eDEX-UI.exe	146
PID 3196 wrote to memory of 772	3196	eDEX-UI.exe	999

C:\Users\Admin\AppData\Local\Temp\eDEX-UI-Windows-x64.exe
"C:\Users\Admin\AppData\Local\Temp\eDEX-UI-Windows-x64.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3388

C:\Users\Admin\AppData\Local\Programs\eDEX-UI\eDEX-UI.exe
"C:\Users\Admin\AppData\Local\Programs\eDEX-UI\eDEX-UI.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Users\Admin\AppData\Local\Programs\eDEX-UI\eDEX-UI.exe
  "C:\Users\Admin\AppData\Local\Programs\eDEX-UI\eDEX-UI.exe" --type=gpu-process --field-trial-handle=1476,16034279279660633697,3110542955569972759,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --enable-gpu-rasterization --gpu-preferences=SAAAAAAAAADgAABwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1484 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2804
- C:\Users\Admin\AppData\Local\Programs\eDEX-UI\eDEX-UI.exe
  "C:\Users\Admin\AppData\Local\Programs\eDEX-UI\eDEX-UI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1476,16034279279660633697,3110542955569972759,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1860 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5536
- C:\Windows\system32\conhost.exe
  \\?\C:\Windows\system32\conhost.exe --headless --width 80 --height 24 --signal 0x7a4 --server 0x79c
  2⤵
  PID:1076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3148
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:6000
- C:\Users\Admin\AppData\Local\Programs\eDEX-UI\eDEX-UI.exe
  C:\Users\Admin\AppData\Local\Programs\eDEX-UI\eDEX-UI.exe C:\Users\Admin\AppData\Local\Programs\eDEX-UI\resources\app.asar\_multithread.js
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6104
  - - C:\Windows\system32\chcp.com
      chcp
      4⤵
      PID:1484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe logicaldisk get Caption,FileSystem,FreeSpace,Size"
    3⤵
    PID:5692
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:2776
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe logicaldisk get Caption,FileSystem,FreeSpace,Size
      4⤵
      Collects information from the system
      PID:5460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:2836
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:1040
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:5340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    PID:5444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage"
    3⤵
    PID:2232
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:1484
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage
      4⤵
      PID:5144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:5188
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:5308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:1708
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:2512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:3724
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:1032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:6360
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:6644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:7064
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:2248
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:5048
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:7088
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:6652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:8108
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:4364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:6412
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:8408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:7108
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      PID:8112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe process get /value"
    3⤵
    PID:6328
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8144
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe process get /value
      4⤵
      PID:8464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:7340
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      Gathers network information
      PID:7032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:5756
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      PID:7036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:7988
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      Gathers network information
      PID:3084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:1524
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      Gathers network information
      PID:6784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:8768
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:2224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:7932
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:8884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:7436
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:1520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:7508
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      PID:8676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:2540
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      PID:8572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:6140
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:9164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:6988
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:1728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:6780
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:7564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:2336
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      PID:7892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:8820
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8220
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:7344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:7664
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:8104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:7052
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:8012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:4052
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:9104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:4888
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:6636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:8860
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7996
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:4864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:196
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6524
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:1868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:9176
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:6924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:8484
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:2340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:7696
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:7936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:6660
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:1508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:6436
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:3780
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:7788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:3612
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8652
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:7420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:6632
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:7512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:5272
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:8576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:6968
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:2848
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:7580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:5800
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8836
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:6164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7380
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:8208
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:2512
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:4364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage"
    3⤵
    PID:2604
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:1268
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage
      4⤵
      PID:7040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe process get /value"
    3⤵
    PID:7432
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6592
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe process get /value
      4⤵
      PID:7228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage"
    3⤵
    PID:5140
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7124
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage
      4⤵
      PID:8332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:6744
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8564
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:7984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe csproduct get /value"
    3⤵
    PID:7880
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8348
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe csproduct get /value
      4⤵
      PID:8904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:5884
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:9084
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:5604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe /namespace:\\root\wmi path MS_SystemInformation get /value"
    3⤵
    PID:5048
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7876
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe /namespace:\\root\wmi path MS_SystemInformation get /value
      4⤵
      PID:3952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe bios get Version, SerialNumber, SMBIOSBIOSVersion"
    3⤵
    PID:8284
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:2392
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe bios get Version, SerialNumber, SMBIOSBIOSVersion
      4⤵
      PID:5580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:7512
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6280
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:7576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_SystemEnclosure get /value"
    3⤵
    PID:6876
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7792
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_SystemEnclosure get /value
      4⤵
      PID:4880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:8416
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:1268
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:7192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:7460
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8920
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:7320
- C:\Users\Admin\AppData\Local\Programs\eDEX-UI\eDEX-UI.exe
  C:\Users\Admin\AppData\Local\Programs\eDEX-UI\eDEX-UI.exe C:\Users\Admin\AppData\Local\Programs\eDEX-UI\resources\app.asar\_multithread.js
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6020
  - - C:\Windows\system32\chcp.com
      chcp
      4⤵
      PID:1836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1088
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:1256
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:4492
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:5664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:3076
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:5896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:2868
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:4300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:5144
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      PID:2032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:924
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:1032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:5376
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:4464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:648
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:5896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:6708
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:6996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:6724
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7272
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:7392
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    PID:6732
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:6808
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7224
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:7336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage"
    3⤵
    PID:1700
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7232
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage
      4⤵
      PID:7344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:6828
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7264
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:7360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:576
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      Gathers network information
      PID:7400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:6208
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:7204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:8400
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:8712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:8752
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:9140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:6836
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:6860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:7872
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:6348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:6268
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:1912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:7240
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:6780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:9096
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:5324
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8020
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:7684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:3388
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7992
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:1124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_SystemEnclosure get /value"
    3⤵
    PID:7384
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:1588
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_SystemEnclosure get /value
      4⤵
      PID:5408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:7660
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:5140
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:8884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:6320
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:8672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:4116
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:5688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:7572
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:8160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:8796
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:6120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:6240
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7388
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:5020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:3092
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:6884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:6736
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:1380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:6384
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:8136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:5932
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      PID:8376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:1036
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:5556
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:7000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:7428
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6664
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:4184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:6556
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7984
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:3644
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:2776
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:2984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:5408
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:1032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:2904
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:5696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:3848
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:6996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:5204
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:8092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:1772
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:3916
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:6784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:7476
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7784
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:6076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:8376
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8524
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:8104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:4240
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:1520
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:5640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage"
    3⤵
    PID:6400
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7772
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage
      4⤵
      PID:7480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe process get /value"
    3⤵
    PID:8996
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8620
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe process get /value
      4⤵
      PID:3816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage"
    3⤵
    PID:9180
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7076
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage
      4⤵
      PID:8080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:4264
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:6004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:3896
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:8580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:6368
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:6980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:5872
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      PID:1312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:6752
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      Gathers network information
      PID:5040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
    3⤵
    PID:7844
  - - C:\Windows\system32\reg.exe
      reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
      4⤵
      PID:7316
- C:\Users\Admin\AppData\Local\Programs\eDEX-UI\eDEX-UI.exe
  C:\Users\Admin\AppData\Local\Programs\eDEX-UI\eDEX-UI.exe C:\Users\Admin\AppData\Local\Programs\eDEX-UI\resources\app.asar\_multithread.js
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:488
  - - C:\Windows\system32\chcp.com
      chcp
      4⤵
      PID:2080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe csproduct get /value"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:784
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:1340
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe csproduct get /value
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe logicaldisk get Caption,FileSystem,FreeSpace,Size"
    3⤵
    PID:3988
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:4292
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe logicaldisk get Caption,FileSystem,FreeSpace,Size
      4⤵
      Collects information from the system
      PID:1924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe /namespace:\\root\wmi path MS_SystemInformation get /value"
    3⤵
    PID:736
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:5348
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe /namespace:\\root\wmi path MS_SystemInformation get /value
      4⤵
      PID:4664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:6000
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      Gathers network information
      PID:4148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:5068
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:4168
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:4864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:1688
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:3364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:5308
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:2972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:836
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      Gathers network information
      PID:708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:4844
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:4460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:6424
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:6760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:4376
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:7100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:8048
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:7236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:8260
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8612
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:8648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:8268
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8604
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:8640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:8492
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:9132
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:9196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:9168
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8448
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:6252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:3400
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6184
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:9036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:9196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe bios get Version, SerialNumber, SMBIOSBIOSVersion"
    3⤵
    PID:8112
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6968
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe bios get Version, SerialNumber, SMBIOSBIOSVersion
      4⤵
      PID:9172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:1596
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7648
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:8796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4256
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:8444
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:3544
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:1340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:5976
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:5020
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:3916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:7692
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7116
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:6088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:4764
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7880
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:4128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:7180
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      Gathers network information
      PID:7876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:2480
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:9032
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:5320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:8896
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      Gathers network information
      PID:8408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:2288
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      Gathers network information
      PID:8884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_SystemEnclosure get /value"
    3⤵
    PID:1976
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7548
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_SystemEnclosure get /value
      4⤵
      PID:5272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:6612
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      Gathers network information
      PID:8656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:1728
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8288
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:1912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:7072
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:5552
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:8212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
    3⤵
    PID:8832
  - - C:\Windows\system32\reg.exe
      reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
      4⤵
      PID:6260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe cpu get /value"
    3⤵
    PID:7720
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6376
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe cpu get /value
      4⤵
      PID:6844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_CacheMemory get CacheType,InstalledSize,Purpose"
    3⤵
    PID:796
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:3320
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_CacheMemory get CacheType,InstalledSize,Purpose
      4⤵
      PID:1040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:6292
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      Gathers network information
      PID:6908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:6888
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:5472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:8624
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:1768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:7456
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:2624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:832
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      PID:6004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:4864
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:6148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:6344
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:9184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:8724
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:6404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:6120
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      PID:3620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:8620
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:2596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:6884
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:8500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:8448
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:7084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:2568
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:7748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe process get /value"
    3⤵
    PID:8212
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7776
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe process get /value
      4⤵
      PID:5488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:7184
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:4420
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:6164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:8756
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6448
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:6216
- C:\Users\Admin\AppData\Local\Programs\eDEX-UI\eDEX-UI.exe
  C:\Users\Admin\AppData\Local\Programs\eDEX-UI\eDEX-UI.exe C:\Users\Admin\AppData\Local\Programs\eDEX-UI\resources\app.asar\_multithread.js
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Windows\system32\chcp.com
      chcp
      4⤵
      PID:6044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:572
  - - C:\Windows\system32\reg.exe
      reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
      4⤵
      Checks processor information in registry
      PID:424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe cpu get /value"
    3⤵
    PID:5004
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:380
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe cpu get /value
      4⤵
      PID:5056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_CacheMemory get CacheType,InstalledSize,Purpose"
    3⤵
    PID:4532
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:5488
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_CacheMemory get CacheType,InstalledSize,Purpose
      4⤵
      PID:5088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:788
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:5792
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:1500
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:2328
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:4408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:5088
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:4076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:6024
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:4408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:1264
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:3848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:3140
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      Gathers network information
      PID:5932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:1972
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:3896
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:6120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:5772
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:5756
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:5140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:6284
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6616
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:6624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:7440
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8180
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:5420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:7960
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:5676
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:7608
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    PID:7796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:8944
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8536
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:8656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    PID:8964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:8712
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6504
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:7820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    PID:8696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:7672
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:6380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:8808
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:6356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:7980
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:1200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:4996
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      PID:6728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:5684
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6116
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:5232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_SystemEnclosure get /value"
    3⤵
    PID:5480
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7480
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_SystemEnclosure get /value
      4⤵
      PID:8508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:6276
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      Gathers network information
      PID:8420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:904
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      Gathers network information
      PID:588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:5224
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      Gathers network information
      PID:8368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:3036
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      Gathers network information
      PID:8836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage"
    3⤵
    PID:9092
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8008
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage
      4⤵
      PID:6548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:1380
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:5900
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:1728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage"
    3⤵
    PID:6636
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:1124
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage
      4⤵
      PID:5672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage"
    3⤵
    PID:7468
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7964
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage
      4⤵
      PID:6832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:7284
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:3252
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:7644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe process get /value"
    3⤵
    PID:7496
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8608
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe process get /value
      4⤵
      PID:8756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:3824
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7868
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:7644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:2912
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:8772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:6544
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:8012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:7360
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:8672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:1316
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:1060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:7452
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7196
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:5556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:9104
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:1616
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:4320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:1092
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:2776
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:7164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:4652
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:7608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:7248
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:5864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:7744
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:7516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:8264
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:3672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:5604
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:5696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:3984
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:8856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:7668
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:6712
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:7304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:2032
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:5792
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:5440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3272
- C:\Users\Admin\AppData\Local\Programs\eDEX-UI\eDEX-UI.exe
  C:\Users\Admin\AppData\Local\Programs\eDEX-UI\eDEX-UI.exe C:\Users\Admin\AppData\Local\Programs\eDEX-UI\resources\app.asar\_multithread.js
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4792
  - - C:\Windows\system32\chcp.com
      chcp
      4⤵
      PID:3536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2272
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6132
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage"
    3⤵
    PID:2680
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:2356
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage
      4⤵
      PID:2972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:5528
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:4908
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:4576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:4908
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:4852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:5436
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:2944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:3352
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:4576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:424
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:1356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:3772
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6212
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:6220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:6500
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6860
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:6888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:7472
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:7876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:7176
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:7432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:708
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:6992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:6932
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:3824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:8460
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8284
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:6844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:6676
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:6496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:8040
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:3068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:8028
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:3344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:7276
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:7780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:8128
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7928
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:8552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:8648
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8524
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:2476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe csproduct get /value"
    3⤵
    PID:7012
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6076
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe csproduct get /value
      4⤵
      PID:2660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:7256
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7352
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:4820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:6824
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:8432
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:7668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:3892
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:6788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:8800
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      PID:6116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage"
    3⤵
    PID:7596
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7788
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage
      4⤵
      PID:7296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:7016
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:5888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:612
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:8356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:4300
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:5468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:6472
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:7668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:3820
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8344
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:2776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe process get /value"
    3⤵
    PID:9080
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8140
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe process get /value
      4⤵
      PID:4576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe /namespace:\\root\wmi path MS_SystemInformation get /value"
    3⤵
    PID:3692
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7360
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe /namespace:\\root\wmi path MS_SystemInformation get /value
      4⤵
      PID:7792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:8936
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7032
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:7452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe bios get Version, SerialNumber, SMBIOSBIOSVersion"
    3⤵
    PID:6820
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6056
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe bios get Version, SerialNumber, SMBIOSBIOSVersion
      4⤵
      PID:7404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe csproduct get /value"
    3⤵
    PID:4556
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6564
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe csproduct get /value
      4⤵
      PID:7416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe /namespace:\\root\wmi path MS_SystemInformation get /value"
    3⤵
    PID:9100
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8360
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe /namespace:\\root\wmi path MS_SystemInformation get /value
      4⤵
      PID:6952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:6948
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8964
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:8620
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    PID:6552
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe bios get Version, SerialNumber, SMBIOSBIOSVersion"
    3⤵
    PID:4728
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:9184
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe bios get Version, SerialNumber, SMBIOSBIOSVersion
      4⤵
      PID:8348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:8424
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:3136
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:9120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:2536
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      Gathers network information
      PID:5524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:7900
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:2112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:6252
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:6972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:4748
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:8476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:8140
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      PID:7540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe process get /value"
    3⤵
    PID:7336
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:4428
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe process get /value
      4⤵
      PID:4432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:2064
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:4588
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:6340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:8812
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      Gathers network information
      PID:8704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:6804
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7304
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:2392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:9036
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:4516
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:5524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:7888
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8916
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:6076
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6664
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:6552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:1424
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:1764
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:4952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    PID:6524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3320
- C:\Users\Admin\AppData\Local\Programs\eDEX-UI\eDEX-UI.exe
  C:\Users\Admin\AppData\Local\Programs\eDEX-UI\eDEX-UI.exe C:\Users\Admin\AppData\Local\Programs\eDEX-UI\resources\app.asar\_multithread.js
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1904
  - - C:\Windows\system32\chcp.com
      chcp
      4⤵
      PID:5272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe process get /value"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2404
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:836
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe process get /value
      4⤵
      PID:5212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:4592
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:3540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:4124
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:2468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:2140
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:3008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:5876
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:1864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:5476
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:5140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:2944
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:2648
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:4588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:6848
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:4772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:6372
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7536
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:7656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
    3⤵
    PID:6312
  - - C:\Windows\system32\reg.exe
      reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
      4⤵
      PID:7680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:6464
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      PID:7416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:6568
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:7780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:5424
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:2904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:8468
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:2904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:8244
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:8916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:2628
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6192
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:3088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:5280
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:7928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:6960
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:1728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:8300
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:2516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:5208
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:6240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:8512
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7576
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:6556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:8536
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:7124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:6672
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:8952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:9048
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:9068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:9132
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:1228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:7208
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7792
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:9136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:764
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:5076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:6668
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:8576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:8880
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:1728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:3740
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:6432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:4452
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:3096
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:8736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:6992
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6964
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:6700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:584
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6876
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:7892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:8952
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7832
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:2412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    PID:3848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe cpu get /value"
    3⤵
    PID:8828
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8384
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe cpu get /value
      4⤵
      PID:7236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_CacheMemory get CacheType,InstalledSize,Purpose"
    3⤵
    PID:7824
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7380
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_CacheMemory get CacheType,InstalledSize,Purpose
      4⤵
      PID:3680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:8272
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:7848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:8908
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:4460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:3536
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:4956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:3484
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:8344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe process get /value"
    3⤵
    PID:6688
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:804
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe process get /value
      4⤵
      PID:7292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:7856
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8832
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:8216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    PID:4264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    PID:9032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe process get /value"
    3⤵
    PID:1020
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6516
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe process get /value
      4⤵
      PID:7916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:6548
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:3936
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:4748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
    3⤵
    PID:1540
  - - C:\Windows\system32\reg.exe
      reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
      4⤵
      PID:7888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe cpu get /value"
    3⤵
    PID:6540
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7200
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe cpu get /value
      4⤵
      PID:6728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_CacheMemory get CacheType,InstalledSize,Purpose"
    3⤵
    PID:7684
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:5760
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_CacheMemory get CacheType,InstalledSize,Purpose
      4⤵
      PID:7544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    PID:5568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage"
    3⤵
    PID:6484
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:1764
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage
      4⤵
      PID:6704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:7204
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6280
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:6896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:1900
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:5792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:5460
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:6896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:4128
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:3232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:9004
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      PID:7140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:7152
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:236
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:8452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:7352
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      Gathers network information
      PID:6364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:9032
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      Gathers network information
      PID:7772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:3048
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8336
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:8784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe process get /value"
    3⤵
    PID:4928
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:9000
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe process get /value
      4⤵
      PID:6380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage"
    3⤵
    PID:8068
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7580
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage
      4⤵
      PID:6404
- C:\Users\Admin\AppData\Local\Programs\eDEX-UI\eDEX-UI.exe
  C:\Users\Admin\AppData\Local\Programs\eDEX-UI\eDEX-UI.exe C:\Users\Admin\AppData\Local\Programs\eDEX-UI\resources\app.asar\_multithread.js
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Windows\system32\chcp.com
      chcp
      4⤵
      PID:1452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5360
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:5408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:5892
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:1688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:4444
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:5228
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      PID:5188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:2500
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      Gathers network information
      PID:4432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:2080
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      Gathers network information
      PID:4588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage"
    3⤵
    PID:5028
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:4692
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage
      4⤵
      PID:5340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe process get /value"
    3⤵
    PID:5012
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6004
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe process get /value
      4⤵
      PID:4420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe csproduct get /value"
    3⤵
    PID:1072
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:1532
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe csproduct get /value
      4⤵
      PID:2904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe /namespace:\\root\wmi path MS_SystemInformation get /value"
    3⤵
    PID:6532
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6832
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe /namespace:\\root\wmi path MS_SystemInformation get /value
      4⤵
      PID:6880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:380
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7116
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:6476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:8064
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:7720
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:7384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:7616
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8476
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:8524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:5116
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8136
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:7716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:8488
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6436
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:6780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe bios get Version, SerialNumber, SMBIOSBIOSVersion"
    3⤵
    PID:4752
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6344
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe bios get Version, SerialNumber, SMBIOSBIOSVersion
      4⤵
      PID:6540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:6816
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      Gathers network information
      PID:5016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:8404
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6600
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:5020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:8804
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:5768
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:5076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:8928
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:8140
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:5760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:7004
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6132
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:3972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3692
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    PID:1200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:8340
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6756
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:6404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    PID:6448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:8848
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:7404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:7096
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:7724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:7552
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:6156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:6232
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:7528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:8464
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6628
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:7172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:7060
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:7216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:5836
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:6492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:6072
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:8744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:4076
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:7588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:7548
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:7832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:8184
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:4184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:9192
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:6224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:7724
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:1788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_SystemEnclosure get /value"
    3⤵
    PID:8780
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6616
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_SystemEnclosure get /value
      4⤵
      PID:8560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:8628
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:2112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:2888
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:6924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:6560
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:9196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:8316
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      PID:588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:7584
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      Gathers network information
      PID:4404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:7924
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6812
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:6864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:6476
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6700
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:8392
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe process get /value"
    3⤵
    PID:2096
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:4660
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe process get /value
      4⤵
      PID:6520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage"
    3⤵
    PID:8700
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6444
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe pagefile get AllocatedBaseSize, CurrentUsage
      4⤵
      PID:8124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value"
    3⤵
    PID:684
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:3620
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe Path Win32_Battery Get /value
      4⤵
      PID:7652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value"
    3⤵
    PID:1768
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:6800
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe path Win32_PerfRawData_Tcpip_NetworkInterface Get name,BytesReceivedPersec,BytesSentPersec,BytesTotalPersec,PacketsOutboundDiscarded,PacketsOutboundErrors,PacketsReceivedDiscarded,PacketsReceivedErrors /value
      4⤵
      PID:7348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
    3⤵
    PID:7788
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -nao
      4⤵
      Gathers network information
      PID:8068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:6776
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:8188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
    3⤵
    PID:6520
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
      4⤵
      PID:3696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
    3⤵
    PID:6928
  - - C:\Windows\system32\netsh.exe
      netsh lan show profiles
      4⤵
      PID:7488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:6844
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      PID:2312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get /value"
    3⤵
    PID:1600
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe nic get /value
      4⤵
      PID:6444
- C:\Users\Admin\AppData\Local\Programs\eDEX-UI\eDEX-UI.exe
  "C:\Users\Admin\AppData\Local\Programs\eDEX-UI\eDEX-UI.exe" --type=renderer --field-trial-handle=1476,16034279279660633697,3110542955569972759,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Programs\eDEX-UI\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2468 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3996
- C:\Users\Admin\AppData\Local\Programs\eDEX-UI\eDEX-UI.exe
  "C:\Users\Admin\AppData\Local\Programs\eDEX-UI\eDEX-UI.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1476,16034279279660633697,3110542955569972759,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3584

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:7636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 62KB
SHA256 4034fc89af0ab93537d4c5bce15dc7b5e99584c4cff09400979d093c4cb093f3
MD5 102f47700eb1ad2c8a4c6ddf9321afec
SHA1 58d14e93b3f7b06a9dd4da5dd95f2168f8f2c79e
SHA512 68e9ce81cc003d425d6310a6a3c8dc4d66039292b4920eeed4e0bd527b502e030c1440903587f1c39da5c9531aae5aaffa0c390a08e5ad1f757ef2b524dfda77
SSDEEP 1536:/flJd+h4iUxoYgYkfvuJfKQiUp/yi11ODa5dbN++jH0YILM4bCwgV3CNBQkj2PMW:/flJd+qiUoYgYkfvuJfKQiUp/yi11OD2
TLSH
T1FD538292E9204E75E2A65F3EF15622627D30394690F8113212DC25EFA987D930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 2ec11bb0db0b04f873dcdba470427a95f7ccd6f962cebe6334e3707ffbc2c805
MD5 c13311c1953399940a2dbd2c541df7a9
SHA1 6d22683aeff72e7e2972c75b7deb6b07c8140d44
SHA512 b028a64ca9d185ce8f0453c1e823644307ef2273e6bd5ac1ef7902bc0d535952ba707c171562e35997cdb6ec2b8d2e1d0be6788cb759d4c4ee7b352ad835e6c1
TLSH
T168216723B78CC7A9C8D955BD10D4AC01B1A783C7809ECECB6A8CC118957F5ABCB645A5
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\eDEX-UI\chrome_100_percent.pak
Size 123KB
SHA256 f1a935db8236203cbc1dcbb9672d98e0bd2fa514429a3f2f82a26e0eb23a4ff9
MD5 a59ea69d64bf4f748401dc5a46a65854
SHA1 111c4cc792991faf947a33386a5862e3205b0cff
SHA512 12a1d953df00b6464ecc132a6e5b9ec3b301c7b3cefe12cbcad27a496d2d218f89e2087dd01d293d37f29391937fcbad937f7d5cf2a6f303539883e2afe3dacd
SSDEEP 3072:YerKzw9bpxlr+bEfF2DGb0+VvfGGY304F2DExm/KLQ2I:YeKzw9Vh90Gb0OveGe04mExhLY
TLSH
T187C3D0D373F0ED7DCF6756B7A52A41B1ECB302391A92034A469AD8356A27348DDC8393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\eDEX-UI\chrome_200_percent.pak
Size 183KB
SHA256 7f9ded50d81c50f9c6ed89591fa621fabbd45cef150c8aabcceb3b7a9de5603b
MD5 1985b8fc603db4d83df72cfaeeac7c50
SHA1 5b02363de1c193827062bfa628261b1ec16bd8cf
SHA512 27e90dd18cbce0e27c70b395895ef60a8d2f2f3c3f2ca38f48b7ecf6b0d5e6fefbe88df7e7c98224222b34ff0fbd60268fdec17440f1055535a79002044c955b
SSDEEP 3072:yDfDQYaEM+9bslr+bEfEfRIGMR+F8fQnYw9pGbXGYoDd+qHqRxmeK/rIM0:6DQYaF+9bMhCWGMRe8InVXYopym74
TLSH
T12E04D1D7A3F49D3CDAB30A77553A01F1ECB6127516A3424A42DBAC347A5678C4CC9293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Programs\eDEX-UI\d3dcompiler_47.dll
Size 4.3MB
SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
MD5 7641e39b7da4077084d2afe7c31032e0
SHA1 2256644f69435ff2fee76deb04d918083960d1eb
SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
TLSH
T16F267D5677A840A9C27BC178CA574313EBB1781403349BEF55A0C665EF33BD26E3A728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Programs\eDEX-UI\ffmpeg.dll
Size 2.7MB
SHA256 9a59bae32311b1c3c0e1b006bcb958f2e3d7bce5b4345d7a042145b1fb13be67
MD5 56482e7183ee77e7aea816d750911c85
SHA1 5feaa9d90fcc2efcc6779d40aa3ef5b46d6d41cb
SHA512 167b558001551faff12bf527513ee6c4bb4720ec3d458870a2fe3caec72a02b153e864b17520b0cfa7e9c535f46fa5cbbe95665f16fe506cca6b67fa01ad6fe0
SSDEEP 49152:cOFsAJ5tTcoQ1RjUBA6vX2T504VsQUacZS8vJrEDE+oM0iloSa08UxdiVqAy6cTC:UjUBA6adUaiRsdiVq4
TLSH
T154D59D0BF2A645DDC029C53083AFA233F934394A4725A6EF16A156252F3FFD0667EB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Programs\eDEX-UI\icudtl.dat
Size 9.9MB
SHA256 02db39ba465fc8b7a4cd280732760f29911edde87b331bf7cea7677e94d483e0
MD5 70499b58dc18e7ee1d7452a1d7a8bc6e
SHA1 41c5382f08c6a88670ce73a20c0dcdb3822f19e9
SHA512 a80939e9809bb7d20f00ad685c94d5c182fa729616c975e605abf09afb58376be73a49fefa35b75ed1a284eccf208af7656c8df44c5959df7eaf51367d232dc6
SSDEEP 196608:uUGwSv9AAQnt6liXUxR0rHa93WhlU6t7CLhl:uoKlQnAliXUxR0rHa93WhlU6t+Ln
TLSH
T131A63947A2FB4DC2F9FBAF30D8F452679467BD496E32805A11042F3B5C373A096617A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Programs\eDEX-UI\libEGL.dll
Size 436KB
SHA256 ca5e57feca16ea6077ff970fad0302be84f88bd4d35f98cdcfca0ed9563f84fa
MD5 03e638e45bccaff2fc672fdb1010bf96
SHA1 8f0bd2a749dc321147bd085db60aaacabacae7d3
SHA512 635f3310e7d0e9d94b19165af51d5cd8606f2938a54db2645c530b01ca3c838f6e930514d7d14053a0adcfd5989b4dbbe7087c5aacdd493c0413969eaf384af2
SSDEEP 6144:zqceFLWA9VpMiOhcj67CY5fpakiMKOjR7aV5Q0T62eyiXj1/2:zqHX9fXGcj6zahtT6jDs
TLSH
T17F947D15F79418A8D036C434CA634A43DA71B8DA0B74EAEF1294927E2F7B7E45B3D324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\Programs\eDEX-UI\libglesv2.dll
Size 7.5MB
SHA256 80f3ab8aa85be2800ed22e658d0c9972ae04792c71f5349265536f9fd5f6b8a9
MD5 66aaa9d93050b55fe54f37c8b7349a46
SHA1 200b9b7a22fef8468acaf38b1aa949f694ecc635
SHA512 a0d377336f6c713180fb71d7e4fce2ed41dc5104cb09263a0122d8caf6579451422d49dc8e0144a37abe1ad4ad77eb45454a9a7f4fbe38bf5840a865b366c9d6
SSDEEP 98304:+5ZYUK7dMfHgFyz3+gRDIsRK7Xdw6OLty+Dy:OPK7djG0ZXdbUty
TLSH
T11A865B07F1A040EDD41DC2788B5B9622E631BC491765F6CF269477062FBABE0A73EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Programs\eDEX-UI\locales\en-US.pak
Size 85KB
SHA256 ac1cdb4fb4d9fb27a908ed0e24cc9cc2bd885bc3ffba7e08b0b907fd4d1a8c4b
MD5 6bbeeb72daebc3b0cbd9c39e820c87a9
SHA1 bd9ebec2d3fc03a2b27f128cf2660b33a3344f43
SHA512 66944fb1abcc2a7e08e5fd8a2cee53eb9da57653d7880aea226f25879e26379f7d745ebf62a3518378fa503f3a31b3ea3716f49fe4c7db4f4af0228b81b53a10
SSDEEP 1536:MzBh0wu6Y90fYSKD0R4RlQ2trhWMJ5dBxgMSO0JedMVrBHhQYVfD3ggl+C/fpkwG:6hp1YSwhBxgrvQY3ggl+CGwG
TLSH
T1BB835E1BE3C41266099243227F06E3B6AB26D079936311663C6CC16C3777FA982777E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Programs\eDEX-UI\resources.pak
Size 4.9MB
SHA256 367467609a389b67600628760c26732fc1a25f563f73263bc2c4bf6eec9033df
MD5 5507bc28022b806ea7a3c3bc65a1c256
SHA1 9f8d3a56fef7374c46cd3557f73855d585692b54
SHA512 ae698d4feacc3e908981ee44df3a9d76e42a39bf083eaf099442ace2b863f882b43232e26e2c18051ca7aec81dccef5742acc7b82fb0cda2e14086b14d5a9a26
SSDEEP 98304:1jMQZikLH2tMPwSGBNumogFJlFlh1wTJntwyqWBsCiLeD8crwrb:tMqimHmGfgfhyTh8YsCi6Qckrb
TLSH
T1FB362302F2E4283BC6DB31766C6BA161B73444471068BD2E7A9D52DCAF5492802FEFF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Programs\eDEX-UI\resources\app.asar
Size 49.8MB
SHA256 c7bcfe16edc42840988822a5273ac792e0a1c433d2837acf3d1444c74e0cd09e
MD5 204f887d1985179a47e65a401d7eca6b
SHA1 367024a1dbbace4f4bfee6a800320915a5e01ce4
SHA512 01717e78d1471f4eb3f6a8145467e76e469b55129f59e0dd83343c83f6255921b2791195845735209087a06cac1a7fb569da79f5b866b83301a84bdc30358f84
SSDEEP 196608:jSSjX1Qc5aDlAqdtoaX0OFnjYcWSSrUwY9syL6z1NNdSYcWSSrUwB:jSSLaqq+XOFnhSrUw8syL4diSrUwB
TLSH
T102B7397512A39872C71BAABB0E9B1042BD3470CB6654C4147E4CC6857F96F28B2F5FB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

conpty.node

Path C:\Users\Admin\AppData\Local\Programs\eDEX-UI\resources\app.asar.unpacked\node_modules\node-pty\build\Release\conpty.node
Size 298KB
SHA256 5070c20319b7448d225cd2064eb11d8f660e2c9e8369c7ee4044921911d96bbe
MD5 cc6abb2e45324e49ed8f3fa995972adb
SHA1 0f261f17108aa283d3d9c9e2944b561feffd5b66
SHA512 9db3acd1ee60ceae6f3c99f932fcfad3fea2b27fbd4ff6392baa5e3dce453e1668bf0b23ad2db669ed11bb1a6e5defe98d8daa996c1068d79d0339a38795900f
SSDEEP 6144:sRWbJfZ7ZWLEonkwn48eaLZLKUOZ+aohzovYLU:sRA9ZWLEokivLZUZ+ao
TLSH
T138547C0AB3A504BAE577823CC8535906E7F2B8150771D6EF43A0465A3F737E0A93EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

link.write.1.tlog

Path C:\Users\Admin\AppData\Local\Programs\eDEX-UI\resources\app.asar.unpacked\node_modules\node-pty\build\deps\winpty\src\Release\obj\winpty-agent\winpty-agent.tlog\link.write.1.tlog
Size 8KB
SHA256 20cb007d0ad86de644de0d147b5dcbe94031e2d22158dd6e5da76c07f83cec20
MD5 d52994a2459a1b33a375b1bab7d739b1
SHA1 af43644add31d6d1c88a73b2ac60f5159bb5c43a
SHA512 5e7d412a64a71291707d3544271d66dcabc11036e72a0c20969617f170b25e2bfc992d4227afd4bd7be29c4be4a42adb040d9ef18ce2844f0c1631f9d2825a8a
SSDEEP 48:rcdcOMj98C7800C6vMEMSMFm72Z5f7L65M1kOyXS70MSL72/cLFXj4:MGpwtXwq5JS+0
TLSH
T1F802AB2930ED748DA3BD35660FEEDABDD69AF2E487878A2F007096074254CD14B119B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventEmitter2.js

Path C:\Users\Admin\AppData\Local\Programs\eDEX-UI\resources\app.asar.unpacked\node_modules\node-pty\lib\eventEmitter2.js
Size 1KB
SHA256 3884d2f24061ff5989c9085945d596e2837b53469d7c41985944f3281f2e137e
MD5 ecfc049b61f87bb2ab4b1f21f2f12105
SHA1 d70bdd9c1d338d110f996c2b6523d2ac9f57d5cb
SHA512 6e7b4b092379e0c8a0c27cd0a55858a728a907a6cbc796ffe16a68e106081ca310663c977fcf15b9f65a3f99df8dc9b2f7f96dc6023492e9c07177edba0f0816
TLSH
T14231078C5DFA28656096B1BF1B1F9049B0A4C2832019DD15BF1CEBDC5F5FC2896D4DA8
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Programs\eDEX-UI\resources\app.asar.unpacked\node_modules\node-pty\lib\index.js
Size 1KB
SHA256 a90c9bbb72d5c4dc0c4099775596a72c2266e6a54054d4d6c3f3761961e71472
MD5 7cae7f94b821fa5c9c8322935ead1719
SHA1 f831e0cd4c4087502ba52fd627d1dd8b67387525
SHA512 e5159b3cf09d1ce8665618593ab8f48c2dad18a4b81731c69e660a2b65a877e70fdb57e54dbdb06e500ce66774047ea32bba91065cd94771d5cc0a3141afaa50
TLSH
T1273132595DB923A343B020E0560FF346F5BA1273796F4811527CC7C52F3AAE6A1E6E88
MD5 SHA1 SHA512 TLSH

Submit Download

terminal.js

Path C:\Users\Admin\AppData\Local\Programs\eDEX-UI\resources\app.asar.unpacked\node_modules\node-pty\lib\terminal.js
Size 6KB
SHA256 c21656ca0c08d9987b4535b2d42821de0ac332354a44602c3ff0ef317defba4f
MD5 734ba13af6e8e3d3f2767511825adb5c
SHA1 5a68905e1e3d84ac969bfe6d7fa9ff6288262811
SHA512 85a3906d160cacf7eed84de7a2fcad72b06894e8f699500c61b2f9d25442dcb9db9c38462571fd009521162ab2f847309af519808be947147ab19f6863c79d91
SSDEEP 192:4J3yG0WmM53M1MPMjM4fccywMglPX6qO1OyC5OZH1c/+uBKr:FMJM1MPMjMHpgxZol
TLSH
T1C8E100099EBF673182A3B0B84F1B900A7138556B150AD948BC4CCFE45F5A164D6EAFEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

utils.js

Path C:\Users\Admin\AppData\Local\Programs\eDEX-UI\resources\app.asar.unpacked\node_modules\node-pty\lib\utils.js
Size 555B
SHA256 ef3b1daa36f90681255dc5db69dd7fb057633b6dd5743d2837e5086571bbecd9
MD5 32b3de66738b8a3b88f64d3f73a90e8e
SHA1 46a8d5f998e1b0023d96729850644dcf4ace1ab7
SHA512 9a39d42d39761fda802c83a8c66a52b74534956b8ea33da698111b2bd5d79a74453ee2c0f4636bc55c0341e748b245c38e55274452c05b845b5b33863b389b8e
TLSH
T111F08B4FA479A4F2166244E90227F185F8294183E0A6AE09FA58A3D46F328056B91C09
MD5 SHA1 SHA512 TLSH

Submit Download

windowsPtyAgent.js

Path C:\Users\Admin\AppData\Local\Programs\eDEX-UI\resources\app.asar.unpacked\node_modules\node-pty\lib\windowsPtyAgent.js
Size 11KB
SHA256 8e64831f359a180f874b6110d03d6de066d332d201f4ddf67630e0a84132e53a
MD5 d8a63c60544ed5e14a8e3e17f4ad7d24
SHA1 eb131d759312b8cf69762941295f83eba2dda9fd
SHA512 d353b0dbd2a21bb48f02ab6691c5105cc8701a681ee375d45a814dcfe57a78614c22f133991ae06aebd5e4610dd44c969d2c8021098802325825cfe82bd93522
SSDEEP 192:Bq2Cp/f2SCyXFf2SCyKdQxxIMcDA/nhdzUQpSihdvMBvkMGMNaM6M0Kp71Mo/XuY:cZG8cDA/nhdzUMddvMBkMGMNaM6Ml71v
TLSH
T1334232499AFA5271526334B80F2F9043B674D127051ACD24BC9CD7C8AFB606096E9FFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsTerminal.js

Path C:\Users\Admin\AppData\Local\Programs\eDEX-UI\resources\app.asar.unpacked\node_modules\node-pty\lib\windowsTerminal.js
Size 7KB
SHA256 1a47a0cf12284ac3529c35f24e2f639322353e38d4a73bc68f461cac73eb16b8
MD5 e5ca8f1dc4fc844f8c6bb00fd810e534
SHA1 ea9462cdbdf9d761f48bf46d7f200c39c7e75c96
SHA512 ea736a8406d2eee1b2173a37ac9b9a09dce218e5565a82140224d5163d6ee11431d4652d91b6417d6a8089a5844e910e93f3aa5ec28db669cf17301c3d937868
SSDEEP 192:miQZUjgUyZGDcFSvk6bDrZehPe+vsp1gMPM7MBYy:miu7irEtlMPM7M1
TLSH
T1B4E1ED0EADFF2330453331B9472FA607732140771067D5247E5C83C8AF799A5979AAE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Programs\eDEX-UI\resources\app.asar.unpacked\node_modules\node-pty\package.json
Size 838B
SHA256 5a60d28da161aa507e15a9a355beb198380f58238f049992784546ac73663b6e
MD5 9e5bb1c5e555d9f4d0a722d770cd943d
SHA1 16c3737fac4fa31cc51c91ddca05f08fbce5c51c
SHA512 d9d15739169a6a138e77b5f2603c2eef9aeead7d832621b2fe8f1b6e793abcb18009892fe9e1bde11a16b4c1dd6b023ba96b30b104a5c9bc0ea65eaa5a71c594
TLSH
T101010410DC598D631AD85A859CBA4602B2244D538D65FC0873E35A7E8F1C2FF21BDA2D
MD5 SHA1 SHA512 TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Programs\eDEX-UI\v8_context_snapshot.bin
Size 160KB
SHA256 31c3aa5645b5487bf484fd910379003786523f3063e946ef9b50d257d0ee5790
MD5 b64c1fc7d75234994012c86dc5af10a6
SHA1 d0d562b5735d28381d59d0d86078ff6b493a678e
SHA512 6218fcb74ef715030a2dd718c87b32f41e976dd4ce459c54a45341ee0f5ca5c927ad507d3afcffe7298b989e969885ed7fb72030ea59387609e8bd5c4b8eb60a
SSDEEP 3072:pBgpuz1xV9mRTUAnPH5lZw15qCy0CmiRNiA0hTBAzZs7q/JBXTPv:p4O1xoTPyqIRhTBAzZs7kJ1TPv
TLSH
T1F2F3121427D0829096ED4094A25B06E7C5D26C6D1E2CFF0A3BB5FD4C0AA3DCE55FE1B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_arzge4oh.1xj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_arzge4oh.1xj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl53AA.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl53AA.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl53AA.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
TLSH
T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl53AA.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl53AA.tmp\nsDialogs.dll
Size 9KB
SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
TLSH
T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl53AA.tmp\nsProcess.dll
Size 4KB
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
TLSH
T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl53AA.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

en-US.json

Path C:\Users\Admin\AppData\Roaming\eDEX-UI\keyboards\en-US.json
Size 10KB
SHA256 fe51d401d971340138f408152265c2fe63ec19d6223265b6d5b8aa7d22655261
MD5 bc55ce00bbd14c2a679219fe3c8a8ac8
SHA1 d85b2bc90f876754104c1334f0b6119ede668886
SHA512 2422f78036d1b4182793a5f4f3263df5dc9f8e05f504d2c014ecfd152739675f8a3b0d005d413910bccc6897f6a11873fa6f7fef83994cf6418ce7b2e26f23c5
SSDEEP 192:cqRyl7VxxjsQUEGvea357tWf98iCaMfgbPREME2O+7miH:cqQn
TLSH
T1BF32D257C76B4D07183752FE66342262FA65537F0B9F3D073A3C6C4D9FB6882220AA18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lastWindowState.json

Path C:\Users\Admin\AppData\Roaming\eDEX-UI\lastWindowState.json
Size 29B
SHA256 5eac0c54997b0b7d9ddc518ef233414f075e105581d98bc7e9ea972e1fa04cc1
MD5 be20f9750106c43540621c4baddc7300
SHA1 9cf7ddead48a939c576c4425f91144dc2092ffea
SHA512 842dd5e7794787fd07f2fb87481de2855a6e2ef9bbfaa4156ec7964746550bc5271ed29b71f542dec8845d8c26bad91a965c8a05ef2c2f10f2f1b8d602e8262c
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\eDEX-UI\settings.json
Size 593B
SHA256 e2ade3badfeb5a7e80c00471ab4341080426f65ba537252fb4035e7b7aa47f70
MD5 94e29342b43ad4dae9cd396f35648115
SHA1 931c06e49e868619f415af744ccceb65df40fd1b
SHA512 88a662c8dc86ddfc5a7938fdb32ecc56b168abf949dc5ee24d06ed230e626100cb426a9ed92205bab31548989863a76a5185e9729ab64331e6e9893e641a52cd
TLSH
T123F0F024E2088DFE66D990BD9D6C83970A1081035C943C08B780868C3F0EB3E71F59E9
MD5 SHA1 SHA512 TLSH

Submit Download

shortcuts.json

Path C:\Users\Admin\AppData\Roaming\eDEX-UI\shortcuts.json
Size 1KB
SHA256 a4162d9c48383c5d497a8573e60c23cebf33e7cbab8402fd79eac584bcbb3eca
MD5 056bd4287d588fd6a57d368ecf72d2a6
SHA1 45c373652e38234663a56e8a7a54d2eb3e0c71b9
SHA512 2bc3636f257207dbb327cdce3c14b0b2c54ebb247a726b6a94f04c45dc8472ad8c162a49d90ff3673ad7820db135777e06b0cdda3959f77ffdbe6613ce215137
TLSH
T1DD317554CE581CB70019D134816A598330B14A2B5D673CB87B5C183C9F2D3BF1ABE79D
MD5 SHA1 SHA512 TLSH

Submit Download

tron.json

Path C:\Users\Admin\AppData\Roaming\eDEX-UI\themes\tron.json
Size 713B
SHA256 56e5fe3e6f4029a7715271c476e09360a9089b298c7bb66b983e685f273e8362
MD5 a6930274b6d4a6335e43475162ed50f7
SHA1 156400e20d621a7bc6867c7895261b96f49f7be2
SHA512 f51640716572895a982c7c34b0f2cbb9830dc21962f9cdd7560f4f6765df7eca976e78b232e80114118ed0fb4aa827cee1e0a5176f1c66c98a0010763cb8276f
TLSH
T1B801FC36CC552C6372FA467B38B90362F006731F428A4657363C69CC0F3242B4952B2E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/536-871-0x0000025275900000-0x0000025275912000-memory.dmp

Download

memory/536-870-0x000002525D260000-0x000002525D26C000-memory.dmp

Download

memory/772-860-0x000001B78E440000-0x000001B78E44C000-memory.dmp

Download

memory/772-837-0x000001B78E440000-0x000001B78E44C000-memory.dmp

Download

memory/772-834-0x000001B7A6CD0000-0x000001B7A6CDA000-memory.dmp

Download

memory/772-838-0x000001B78E8B0000-0x000001B78E8C2000-memory.dmp

Download

memory/772-828-0x000001B7A70B0000-0x000001B7A7163000-memory.dmp

Download

memory/772-827-0x000001B7A6CF0000-0x000001B7A6D0C000-memory.dmp

Download

memory/772-835-0x000001B7A7270000-0x000001B7A729A000-memory.dmp

Download

memory/772-836-0x000001B7A7270000-0x000001B7A7294000-memory.dmp

Download

memory/1664-854-0x000001FEF7FA0000-0x000001FEF7FAC000-memory.dmp

Download

memory/1664-855-0x000001FEF9870000-0x000001FEF9882000-memory.dmp

Download

memory/1664-1055-0x000001FEF7FA0000-0x000001FEF7FAC000-memory.dmp

Download

memory/1772-1093-0x00000256CD920000-0x00000256CD92C000-memory.dmp

Download

memory/1772-830-0x00000256CD920000-0x00000256CD92C000-memory.dmp

Download

memory/1772-831-0x00000256CF520000-0x00000256CF532000-memory.dmp

Download

memory/2076-1614-0x000001BE7CB00000-0x000001BE7CBB3000-memory.dmp

Download

memory/2480-1090-0x000001DB7BE80000-0x000001DB7BE8C000-memory.dmp

Download

memory/2480-884-0x000001DB7D9B0000-0x000001DB7D9C2000-memory.dmp

Download

memory/2480-883-0x000001DB7BE80000-0x000001DB7BE8C000-memory.dmp

Download

memory/2644-750-0x0000027347CC0000-0x0000027347D06000-memory.dmp

Download

memory/2644-763-0x0000027347810000-0x0000027347822000-memory.dmp

Download

memory/2644-762-0x000002732D960000-0x000002732D96C000-memory.dmp

Download

memory/2644-682-0x0000027347880000-0x00000273478A2000-memory.dmp

Download

memory/2776-881-0x0000021D87C10000-0x0000021D87C1C000-memory.dmp

Download

memory/2776-1088-0x0000021D87C10000-0x0000021D87C1C000-memory.dmp

Download

memory/2776-882-0x0000021D87D90000-0x0000021D87DA2000-memory.dmp

Download

memory/2804-759-0x000002A1F2080000-0x000002A1F20A9000-memory.dmp

Download

memory/2804-656-0x00007FF849BA0000-0x00007FF849BA1000-memory.dmp

Download

memory/3388-578-0x0000000004A00000-0x0000000004A06000-memory.dmp

Download

memory/5260-767-0x0000019F9FB90000-0x0000019F9FBB9000-memory.dmp

Download

memory/5444-873-0x0000015318CB0000-0x0000015318CC2000-memory.dmp

Download

memory/5444-872-0x0000015316F70000-0x0000015316F7C000-memory.dmp

Download

memory/5576-1058-0x0000015BEF5D0000-0x0000015BEF5DC000-memory.dmp

Download

memory/5576-853-0x0000015BF0EA0000-0x0000015BF0EB2000-memory.dmp

Download

memory/5576-852-0x0000015BEF5D0000-0x0000015BEF5DC000-memory.dmp

Download

memory/6080-1084-0x00000235CDE20000-0x00000235CDE2C000-memory.dmp

Download

memory/6080-833-0x00000235CE3A0000-0x00000235CE3B2000-memory.dmp

Download

memory/6080-832-0x00000235CDE20000-0x00000235CDE2C000-memory.dmp

Download

memory/6188-1048-0x0000027194C10000-0x0000027194C1C000-memory.dmp

Download

memory/6188-1049-0x0000027194CC0000-0x0000027194CD2000-memory.dmp

Download

memory/6292-1062-0x000001684B010000-0x000001684B01C000-memory.dmp

Download

memory/6292-982-0x000001684CDB0000-0x000001684CDC2000-memory.dmp

Download

memory/6292-981-0x000001684B010000-0x000001684B01C000-memory.dmp

Download

memory/6300-983-0x000002DAB2420000-0x000002DAB242C000-memory.dmp

Download

memory/6300-984-0x000002DAB2540000-0x000002DAB2552000-memory.dmp

Download

memory/6308-1026-0x000001F1C29D0000-0x000001F1C29DC000-memory.dmp

Download

memory/6308-1080-0x000001F1C29D0000-0x000001F1C29DC000-memory.dmp

Download

memory/6308-1027-0x000001F1C2BF0000-0x000001F1C2C02000-memory.dmp

Download

memory/6580-1249-0x000002D37C0B0000-0x000002D37C163000-memory.dmp

Download

memory/6732-1037-0x000001CE158D0000-0x000001CE158DC000-memory.dmp

Download

memory/6732-1006-0x000001CE2DE60000-0x000001CE2DE72000-memory.dmp

Download

memory/6732-1005-0x000001CE158D0000-0x000001CE158DC000-memory.dmp

Download

memory/6756-1008-0x0000016049650000-0x0000016049662000-memory.dmp

Download

memory/6756-1096-0x00000160313A0000-0x00000160313AC000-memory.dmp

Download

memory/6756-1007-0x00000160313A0000-0x00000160313AC000-memory.dmp

Download

memory/6940-1024-0x000002C071170000-0x000002C07117C000-memory.dmp

Download

memory/6940-1101-0x000002C071170000-0x000002C07117C000-memory.dmp

Download

memory/6940-1025-0x000002C073030000-0x000002C073042000-memory.dmp

Download

memory/6956-1546-0x0000019E1BB80000-0x0000019E1BC33000-memory.dmp

Download

memory/7000-1489-0x0000011FA4940000-0x0000011FA49F3000-memory.dmp

Download

memory/7072-992-0x000001F5EE100000-0x000001F5EE112000-memory.dmp

Download

memory/7072-991-0x000001F5EC3E0000-0x000001F5EC3EC000-memory.dmp

Download

memory/7080-1003-0x0000020FCA3A0000-0x0000020FCA3AC000-memory.dmp

Download

memory/7080-1004-0x0000020FCBD10000-0x0000020FCBD22000-memory.dmp

Download

memory/7448-1065-0x0000024338AD0000-0x0000024338ADC000-memory.dmp

Download

memory/7448-1050-0x0000024338AD0000-0x0000024338ADC000-memory.dmp

Download

memory/7448-1051-0x0000024338CA0000-0x0000024338CB2000-memory.dmp

Download

memory/7464-1053-0x00000243FAD00000-0x00000243FAD12000-memory.dmp

Download

memory/7464-1099-0x00000243F8FC0000-0x00000243F8FCC000-memory.dmp

Download

memory/7464-1052-0x00000243F8FC0000-0x00000243F8FCC000-memory.dmp

Download

memory/7796-1042-0x000002530CB10000-0x000002530CB1C000-memory.dmp

Download

memory/7796-1043-0x0000025324D50000-0x0000025324D62000-memory.dmp

Download

memory/8744-1363-0x0000017D7DFD0000-0x0000017D7E083000-memory.dmp

Download

memory/8952-1110-0x000001BA16B80000-0x000001BA16B92000-memory.dmp

Download

memory/8952-1109-0x000001BA14F70000-0x000001BA14F7C000-memory.dmp

Download