Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    103s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/03/2024, 04:11

General

  • Target

    cddb36a5d37c4a7343f0284b830345ee18ef510c21f8a673d20cc770077ec61a.exe

  • Size

    1.8MB

  • MD5

    aaacf46a89720b66de3ad6b5a2947fa8

  • SHA1

    5718da5742ed0025a1164e6b1bc8c100504408d0

  • SHA256

    cddb36a5d37c4a7343f0284b830345ee18ef510c21f8a673d20cc770077ec61a

  • SHA512

    cb9716cfdf6576f47873a05c7763f0a15c356fe885d76bc516dab7e501fd2fa63e34c4da14a7bb96d86c311849daef9c3167f7be4cfa4c8bf3d14941e6ee225d

  • SSDEEP

    49152:rT7zkGiVDmwpsx7lmnpqNbz1x7WifIVaN0E:n7aZw7lHF7nAVd

Malware Config

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

C2

20.218.68.91:7690

Extracted

Family

risepro

C2

193.233.132.62

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

stealc

C2

http://185.172.128.145

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Extracted

Family

lumma

C2

https://resergvearyinitiani.shop/api

https://colorfulequalugliess.shop/api

https://associationokeo.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect ZGRat V1 6 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 3 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Stealc

    Stealc is an infostealer written in C++.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Stops running service(s) 3 TTPs
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 25 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 42 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 15 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • NSIS installer 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cddb36a5d37c4a7343f0284b830345ee18ef510c21f8a673d20cc770077ec61a.exe
    "C:\Users\Admin\AppData\Local\Temp\cddb36a5d37c4a7343f0284b830345ee18ef510c21f8a673d20cc770077ec61a.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    PID:1904
  • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
    C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2140
    • C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe
      "C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2980
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
          PID:3896
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 1220
            4⤵
            • Program crash
            PID:2084
      • C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime1234.exe
        "C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime1234.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3184
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
            PID:3608
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
              PID:2052
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
            2⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:956
            • C:\Windows\system32\rundll32.exe
              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
              3⤵
              • Blocklisted process makes network request
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:3204
              • C:\Windows\system32\netsh.exe
                netsh wlan show profiles
                4⤵
                  PID:2824
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\570491262506_Desktop.zip' -CompressionLevel Optimal
                  4⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4352
            • C:\Users\Admin\AppData\Local\Temp\1000838001\judith1234.exe
              "C:\Users\Admin\AppData\Local\Temp\1000838001\judith1234.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:3884
              • C:\Users\Admin\AppData\Local\Temp\onefile_3884_133549495347338545\stub.exe
                "C:\Users\Admin\AppData\Local\Temp\1000838001\judith1234.exe"
                3⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of WriteProcessMemory
                PID:4184
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "ver"
                  4⤵
                    PID:4360
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1696
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic path win32_VideoController get name
                      5⤵
                      • Detects videocard installed
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4504
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2664
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic computersystem get Manufacturer
                      5⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4516
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "gdb --version"
                    4⤵
                      PID:980
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "tasklist"
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3472
                      • C:\Windows\system32\tasklist.exe
                        tasklist
                        5⤵
                        • Enumerates processes with tasklist
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1228
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1508
                      • C:\Windows\System32\Wbem\WMIC.exe
                        wmic path Win32_ComputerSystem get Manufacturer
                        5⤵
                          PID:4092
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                        4⤵
                          PID:1140
                          • C:\Windows\System32\Wbem\WMIC.exe
                            wmic csproduct get uuid
                            5⤵
                              PID:3184
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "tasklist"
                            4⤵
                              PID:4936
                              • C:\Windows\system32\tasklist.exe
                                tasklist
                                5⤵
                                • Enumerates processes with tasklist
                                PID:576
                        • C:\Users\Admin\AppData\Local\Temp\1000858001\alex12341.exe
                          "C:\Users\Admin\AppData\Local\Temp\1000858001\alex12341.exe"
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:1544
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            3⤵
                              PID:1088
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              3⤵
                              • Checks computer location settings
                              PID:2228
                              • C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe
                                "C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe"
                                4⤵
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5080
                              • C:\Users\Admin\AppData\Roaming\configurationValue\TWO.exe
                                "C:\Users\Admin\AppData\Roaming\configurationValue\TWO.exe"
                                4⤵
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4488
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
                                4⤵
                                  PID:2440
                                  • C:\Windows\SysWOW64\choice.exe
                                    choice /C Y /N /D Y /T 3
                                    5⤵
                                      PID:5220
                              • C:\Users\Admin\AppData\Local\Temp\1000865001\TeamFour.exe
                                "C:\Users\Admin\AppData\Local\Temp\1000865001\TeamFour.exe"
                                2⤵
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3656
                              • C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe
                                "C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe"
                                2⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                PID:4492
                              • C:\Windows\SysWOW64\rundll32.exe
                                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                                2⤵
                                • Blocklisted process makes network request
                                • Loads dropped DLL
                                PID:5056
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1000874021\random.cmd" "
                                2⤵
                                  PID:2704
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
                                    3⤵
                                    • Enumerates system info in registry
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    PID:4092
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe66e346f8,0x7ffe66e34708,0x7ffe66e34718
                                      4⤵
                                        PID:536
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,9924626398517477735,8477720371824093245,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
                                        4⤵
                                          PID:5384
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,9924626398517477735,8477720371824093245,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
                                          4⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:5392
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,9924626398517477735,8477720371824093245,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3124 /prefetch:8
                                          4⤵
                                            PID:5604
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9924626398517477735,8477720371824093245,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
                                            4⤵
                                              PID:5664
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9924626398517477735,8477720371824093245,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
                                              4⤵
                                                PID:5672
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9924626398517477735,8477720371824093245,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
                                                4⤵
                                                  PID:5904
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
                                                3⤵
                                                  PID:1540
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe66e346f8,0x7ffe66e34708,0x7ffe66e34718
                                                    4⤵
                                                      PID:4724
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,13905267584296726021,6880956590632673158,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
                                                      4⤵
                                                        PID:5788
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,13905267584296726021,6880956590632673158,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
                                                        4⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:5876
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
                                                      3⤵
                                                        PID:5548
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe66e346f8,0x7ffe66e34708,0x7ffe66e34718
                                                          4⤵
                                                            PID:5696
                                                      • C:\Users\Admin\AppData\Local\Temp\1000875001\amadka.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\1000875001\amadka.exe"
                                                        2⤵
                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                        • Checks BIOS information in registry
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Identifies Wine through registry keys
                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                        • Drops file in Windows directory
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of FindShellTrayWindow
                                                        PID:5040
                                                        • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
                                                          3⤵
                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                          • Checks BIOS information in registry
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Identifies Wine through registry keys
                                                          • Adds Run key to start application
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:5980
                                                          • C:\Users\Admin\AppData\Local\Temp\1000010001\lenin.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\1000010001\lenin.exe"
                                                            4⤵
                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                            • Checks BIOS information in registry
                                                            • Executes dropped EXE
                                                            • Identifies Wine through registry keys
                                                            PID:2760
                                                          • C:\Users\Admin\AppData\Local\Temp\1000021001\InstallSetup8.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\1000021001\InstallSetup8.exe"
                                                            4⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            PID:2016
                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN InstallSetup8.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000021001\InstallSetup8.exe" /F
                                                              5⤵
                                                              • Creates scheduled task(s)
                                                              PID:4652
                                                            • C:\Users\Admin\AppData\Local\Temp\1000151001\InstallSetup8.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\1000151001\InstallSetup8.exe"
                                                              5⤵
                                                              • Executes dropped EXE
                                                              PID:116
                                                            • C:\Users\Admin\AppData\Local\Temp\1000152001\4767d2e713f2021e8fe856e3ea638b58.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\1000152001\4767d2e713f2021e8fe856e3ea638b58.exe"
                                                              5⤵
                                                              • Executes dropped EXE
                                                              PID:2396
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell -nologo -noprofile
                                                                6⤵
                                                                  PID:6076
                                                                • C:\Users\Admin\AppData\Local\Temp\1000152001\4767d2e713f2021e8fe856e3ea638b58.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\1000152001\4767d2e713f2021e8fe856e3ea638b58.exe"
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  • Modifies data under HKEY_USERS
                                                                  PID:5352
                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell -nologo -noprofile
                                                                    7⤵
                                                                    • Modifies data under HKEY_USERS
                                                                    PID:6012
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                                                    7⤵
                                                                      PID:2616
                                                                      • C:\Windows\system32\netsh.exe
                                                                        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                                                        8⤵
                                                                        • Modifies Windows Firewall
                                                                        PID:4296
                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell -nologo -noprofile
                                                                      7⤵
                                                                        PID:5692
                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                        powershell -nologo -noprofile
                                                                        7⤵
                                                                          PID:864
                                                                        • C:\Windows\rss\csrss.exe
                                                                          C:\Windows\rss\csrss.exe
                                                                          7⤵
                                                                            PID:4908
                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell -nologo -noprofile
                                                                              8⤵
                                                                                PID:4632
                                                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                                                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                                                8⤵
                                                                                • Creates scheduled task(s)
                                                                                PID:5780
                                                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                                                schtasks /delete /tn ScheduledUpdate /f
                                                                                8⤵
                                                                                  PID:5452
                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell -nologo -noprofile
                                                                                  8⤵
                                                                                    PID:5536
                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                    powershell -nologo -noprofile
                                                                                    8⤵
                                                                                      PID:4028
                                                                                    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                                                                      8⤵
                                                                                        PID:316
                                                                                      • C:\Windows\SYSTEM32\schtasks.exe
                                                                                        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                                                        8⤵
                                                                                        • Creates scheduled task(s)
                                                                                        PID:2988
                                                                                      • C:\Windows\windefender.exe
                                                                                        "C:\Windows\windefender.exe"
                                                                                        8⤵
                                                                                          PID:812
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                                                                            9⤵
                                                                                              PID:1268
                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                                                                                10⤵
                                                                                                • Launches sc.exe
                                                                                                PID:5496
                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000153001\FirstZ.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\1000153001\FirstZ.exe"
                                                                                      5⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:5516
                                                                                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                        6⤵
                                                                                          PID:5464
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                          6⤵
                                                                                            PID:5320
                                                                                            • C:\Windows\system32\wusa.exe
                                                                                              wusa /uninstall /kb:890830 /quiet /norestart
                                                                                              7⤵
                                                                                                PID:1960
                                                                                            • C:\Windows\system32\sc.exe
                                                                                              C:\Windows\system32\sc.exe stop UsoSvc
                                                                                              6⤵
                                                                                              • Launches sc.exe
                                                                                              PID:5496
                                                                                            • C:\Windows\system32\sc.exe
                                                                                              C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                              6⤵
                                                                                              • Launches sc.exe
                                                                                              PID:4876
                                                                                            • C:\Windows\system32\sc.exe
                                                                                              C:\Windows\system32\sc.exe stop wuauserv
                                                                                              6⤵
                                                                                              • Launches sc.exe
                                                                                              PID:2084
                                                                                            • C:\Windows\system32\sc.exe
                                                                                              C:\Windows\system32\sc.exe stop bits
                                                                                              6⤵
                                                                                              • Launches sc.exe
                                                                                              PID:5296
                                                                                            • C:\Windows\system32\sc.exe
                                                                                              C:\Windows\system32\sc.exe stop dosvc
                                                                                              6⤵
                                                                                              • Launches sc.exe
                                                                                              PID:5592
                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                              6⤵
                                                                                                PID:5868
                                                                                              • C:\Windows\system32\powercfg.exe
                                                                                                C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                6⤵
                                                                                                  PID:1736
                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                  6⤵
                                                                                                    PID:5396
                                                                                                  • C:\Windows\system32\powercfg.exe
                                                                                                    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                    6⤵
                                                                                                      PID:4980
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      C:\Windows\system32\sc.exe delete "WSNKISKT"
                                                                                                      6⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:3184
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
                                                                                                      6⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:4732
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      C:\Windows\system32\sc.exe stop eventlog
                                                                                                      6⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:5892
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      C:\Windows\system32\sc.exe start "WSNKISKT"
                                                                                                      6⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:1012
                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                                                                                  4⤵
                                                                                                  • Loads dropped DLL
                                                                                                  PID:3892
                                                                                                  • C:\Windows\system32\rundll32.exe
                                                                                                    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                                                                                    5⤵
                                                                                                    • Blocklisted process makes network request
                                                                                                    • Loads dropped DLL
                                                                                                    PID:1436
                                                                                                    • C:\Windows\system32\netsh.exe
                                                                                                      netsh wlan show profiles
                                                                                                      6⤵
                                                                                                        PID:644
                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                          7⤵
                                                                                                            PID:5520
                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\570491262506_Desktop.zip' -CompressionLevel Optimal
                                                                                                          6⤵
                                                                                                            PID:4416
                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                                                                                                        4⤵
                                                                                                        • Blocklisted process makes network request
                                                                                                        • Loads dropped DLL
                                                                                                        PID:5340
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000903001\lummahelp.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1000903001\lummahelp.exe"
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of SetThreadContext
                                                                                                    PID:5336
                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                      3⤵
                                                                                                        PID:1832
                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                        3⤵
                                                                                                          PID:3344
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1228
                                                                                                            4⤵
                                                                                                            • Program crash
                                                                                                            PID:2936
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000935001\InstallSetup3.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1000935001\InstallSetup3.exe"
                                                                                                        2⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Loads dropped DLL
                                                                                                        PID:1888
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
                                                                                                          3⤵
                                                                                                          • Checks computer location settings
                                                                                                          • Executes dropped EXE
                                                                                                          • Loads dropped DLL
                                                                                                          • Checks processor information in registry
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:1876
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\GDBAKKKFBG.exe"
                                                                                                            4⤵
                                                                                                              PID:2992
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\GDBAKKKFBG.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\GDBAKKKFBG.exe"
                                                                                                                5⤵
                                                                                                                • Checks computer location settings
                                                                                                                • Executes dropped EXE
                                                                                                                • Adds Run key to start application
                                                                                                                PID:5216
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\GDBAKKKFBG.exe
                                                                                                                  6⤵
                                                                                                                    PID:6060
                                                                                                                    • C:\Windows\SysWOW64\PING.EXE
                                                                                                                      ping 2.2.2.2 -n 1 -w 3000
                                                                                                                      7⤵
                                                                                                                      • Runs ping.exe
                                                                                                                      PID:4040
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:5428
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
                                                                                                                4⤵
                                                                                                                  PID:876
                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                    5⤵
                                                                                                                      PID:4724
                                                                                                                    • C:\Windows\SysWOW64\chcp.com
                                                                                                                      chcp 1251
                                                                                                                      5⤵
                                                                                                                        PID:6128
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
                                                                                                                        5⤵
                                                                                                                        • Creates scheduled task(s)
                                                                                                                        PID:5520
                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3896 -ip 3896
                                                                                                                1⤵
                                                                                                                  PID:2332
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3344 -ip 3344
                                                                                                                  1⤵
                                                                                                                    PID:5164
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                    1⤵
                                                                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                    • Checks BIOS information in registry
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Identifies Wine through registry keys
                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                    PID:5800
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000021001\InstallSetup8.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\1000021001\InstallSetup8.exe
                                                                                                                    1⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:6096
                                                                                                                  • C:\ProgramData\wikombernizc\reakuqnanrkn.exe
                                                                                                                    C:\ProgramData\wikombernizc\reakuqnanrkn.exe
                                                                                                                    1⤵
                                                                                                                      PID:4772
                                                                                                                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                        2⤵
                                                                                                                          PID:5720
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                          2⤵
                                                                                                                            PID:5708
                                                                                                                            • C:\Windows\system32\wusa.exe
                                                                                                                              wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                              3⤵
                                                                                                                                PID:4340
                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                              C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                              2⤵
                                                                                                                              • Launches sc.exe
                                                                                                                              PID:3548
                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                              C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                              2⤵
                                                                                                                              • Launches sc.exe
                                                                                                                              PID:2044
                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                              C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                              2⤵
                                                                                                                              • Launches sc.exe
                                                                                                                              PID:3332
                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                              C:\Windows\system32\sc.exe stop bits
                                                                                                                              2⤵
                                                                                                                              • Launches sc.exe
                                                                                                                              PID:5588
                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                              C:\Windows\system32\sc.exe stop dosvc
                                                                                                                              2⤵
                                                                                                                              • Launches sc.exe
                                                                                                                              PID:884
                                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                              2⤵
                                                                                                                                PID:5288
                                                                                                                              • C:\Windows\system32\powercfg.exe
                                                                                                                                C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                2⤵
                                                                                                                                  PID:3676
                                                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                  2⤵
                                                                                                                                    PID:5600
                                                                                                                                  • C:\Windows\system32\powercfg.exe
                                                                                                                                    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                    2⤵
                                                                                                                                      PID:5628
                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                      C:\Windows\system32\conhost.exe
                                                                                                                                      2⤵
                                                                                                                                        PID:2292
                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                        explorer.exe
                                                                                                                                        2⤵
                                                                                                                                          PID:5048
                                                                                                                                      • C:\Windows\windefender.exe
                                                                                                                                        C:\Windows\windefender.exe
                                                                                                                                        1⤵
                                                                                                                                          PID:3316

                                                                                                                                        Network

                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                        Replay Monitor

                                                                                                                                        Loading Replay Monitor...

                                                                                                                                        Downloads

                                                                                                                                        • C:\ProgramData\Are.docx

                                                                                                                                          Filesize

                                                                                                                                          11KB

                                                                                                                                          MD5

                                                                                                                                          a33e5b189842c5867f46566bdbf7a095

                                                                                                                                          SHA1

                                                                                                                                          e1c06359f6a76da90d19e8fd95e79c832edb3196

                                                                                                                                          SHA256

                                                                                                                                          5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                                                                                                                          SHA512

                                                                                                                                          f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                                                                                                                        • C:\ProgramData\mozglue.dll

                                                                                                                                          Filesize

                                                                                                                                          593KB

                                                                                                                                          MD5

                                                                                                                                          c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                                          SHA1

                                                                                                                                          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                                          SHA256

                                                                                                                                          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                                          SHA512

                                                                                                                                          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                          Filesize

                                                                                                                                          152B

                                                                                                                                          MD5

                                                                                                                                          a774512b00820b61a51258335097b2c9

                                                                                                                                          SHA1

                                                                                                                                          38c28d1ea3907a1af6c0443255ab610dd9285095

                                                                                                                                          SHA256

                                                                                                                                          01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

                                                                                                                                          SHA512

                                                                                                                                          ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                          Filesize

                                                                                                                                          152B

                                                                                                                                          MD5

                                                                                                                                          fd7944a4ff1be37517983ffaf5700b11

                                                                                                                                          SHA1

                                                                                                                                          c4287796d78e00969af85b7e16a2d04230961240

                                                                                                                                          SHA256

                                                                                                                                          b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

                                                                                                                                          SHA512

                                                                                                                                          28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                          Filesize

                                                                                                                                          8KB

                                                                                                                                          MD5

                                                                                                                                          04b8442552cd2012033b4a6ddebc6f7f

                                                                                                                                          SHA1

                                                                                                                                          cae4277a4005f959536c9bed190fd31ae9aaca2e

                                                                                                                                          SHA256

                                                                                                                                          62ec0273108da7aff216883f50efc57af76db654c659354d2938c28413a7d0c9

                                                                                                                                          SHA512

                                                                                                                                          e9fb396c2e3c56f615459f9205210de8de3a97bcd3cb210ed8f717e24abb44375a5548a61d8152b521ad413a975a17bc67aaef66c1f4de64e37e17cba08a5f02

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe

                                                                                                                                          Filesize

                                                                                                                                          1.8MB

                                                                                                                                          MD5

                                                                                                                                          aaacf46a89720b66de3ad6b5a2947fa8

                                                                                                                                          SHA1

                                                                                                                                          5718da5742ed0025a1164e6b1bc8c100504408d0

                                                                                                                                          SHA256

                                                                                                                                          cddb36a5d37c4a7343f0284b830345ee18ef510c21f8a673d20cc770077ec61a

                                                                                                                                          SHA512

                                                                                                                                          cb9716cfdf6576f47873a05c7763f0a15c356fe885d76bc516dab7e501fd2fa63e34c4da14a7bb96d86c311849daef9c3167f7be4cfa4c8bf3d14941e6ee225d

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000021001\InstallSetup8.exe

                                                                                                                                          Filesize

                                                                                                                                          418KB

                                                                                                                                          MD5

                                                                                                                                          0099a99f5ffb3c3ae78af0084136fab3

                                                                                                                                          SHA1

                                                                                                                                          0205a065728a9ec1133e8a372b1e3864df776e8c

                                                                                                                                          SHA256

                                                                                                                                          919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                                                                                                                          SHA512

                                                                                                                                          5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000152001\4767d2e713f2021e8fe856e3ea638b58.exe

                                                                                                                                          Filesize

                                                                                                                                          4.1MB

                                                                                                                                          MD5

                                                                                                                                          697358aba01954286f6978b613396fdc

                                                                                                                                          SHA1

                                                                                                                                          60d653e4a6b68a0f22b5f4a5c37a9bfa45c6dc33

                                                                                                                                          SHA256

                                                                                                                                          0562f561c53e33f281f081b9bca0b01d2e252d0399d477b2dcfa8c475bc79c1b

                                                                                                                                          SHA512

                                                                                                                                          2cb1b22d8043d8c9885ed2a23b9ad88269f15bcd409c7773e75cfbd72516b248e4f0cffd36e89c49d6d6380a2203098dcce0944f4f0e408168ad5b23a9978db0

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000153001\FirstZ.exe

                                                                                                                                          Filesize

                                                                                                                                          2.5MB

                                                                                                                                          MD5

                                                                                                                                          ffada57f998ed6a72b6ba2f072d2690a

                                                                                                                                          SHA1

                                                                                                                                          6857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f

                                                                                                                                          SHA256

                                                                                                                                          677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12

                                                                                                                                          SHA512

                                                                                                                                          1de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe

                                                                                                                                          Filesize

                                                                                                                                          534KB

                                                                                                                                          MD5

                                                                                                                                          a3f8b60a08da0f600cfce3bb600d5cb3

                                                                                                                                          SHA1

                                                                                                                                          b00d7721767b717b3337b5c6dade4ebf2d56345e

                                                                                                                                          SHA256

                                                                                                                                          0c608a9b1e70bf8b51a681a8390c8e4743501c45b84cf4d59727aba2fc33cadb

                                                                                                                                          SHA512

                                                                                                                                          14f63e415133ca438d3c217d5fb3ecf0ad76e19969c54d356f46282230230f1b254fbfc8ae5f78809dc189a9648be2dc1398927b3f089c525cd1105a3843f60d

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime1234.exe

                                                                                                                                          Filesize

                                                                                                                                          555KB

                                                                                                                                          MD5

                                                                                                                                          0c4fee8706a8ea370b7a272b7c5bbc85

                                                                                                                                          SHA1

                                                                                                                                          bda2a1ebc921db843d06aa5074884207ccbe9242

                                                                                                                                          SHA256

                                                                                                                                          9ec8397acd7c4106763ba84f4ebe1fd1cf39b4b0de442be8f89cd57de6151aac

                                                                                                                                          SHA512

                                                                                                                                          dd2c1d00325533db2cc5fe14ab52747182a494a2524e4f891e3dcd3ce2ab9685322a9fe1f5f2bd2b9808d6f1efab2a9cdfcc762016935464a7ddd237e620f9a4

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000838001\judith1234.exe

                                                                                                                                          Filesize

                                                                                                                                          6.8MB

                                                                                                                                          MD5

                                                                                                                                          577a83a1e5c8cdf24c6da5a7658ed212

                                                                                                                                          SHA1

                                                                                                                                          0076462eb1bb46840e689603f20526065d54fe3d

                                                                                                                                          SHA256

                                                                                                                                          2233f6b54c9e6bd8be02678d1f29ad0d69bd3e11c96d37163668ed7436eac12f

                                                                                                                                          SHA512

                                                                                                                                          a1c7cd0240a7c849db44ad6541a4e525c1415b2e75ab1cf8441934875bd0de4e0c1b2fc306232c3721ea363fff8d1bd07760ad6aafe515474ae9babde5e98d9a

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000838001\judith1234.exe

                                                                                                                                          Filesize

                                                                                                                                          3.5MB

                                                                                                                                          MD5

                                                                                                                                          db7a02a524cedc646092c2996a3d0778

                                                                                                                                          SHA1

                                                                                                                                          43b61fb7997ac27ebb8b2f9ed7f2adc01edd6538

                                                                                                                                          SHA256

                                                                                                                                          c9097b1eff915c59e69580e598ea540bfcd6271109bb09d9d09475a414fe9211

                                                                                                                                          SHA512

                                                                                                                                          303d12f508cb1b5920b2af7c646447db5d1de6d77c10f286b99a689ea1d5325eaacd83f35baff270078729462b8b143eceeabf6df14c4071d727e18ffa8de90b

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000858001\alex12341.exe

                                                                                                                                          Filesize

                                                                                                                                          1.7MB

                                                                                                                                          MD5

                                                                                                                                          2b648280f8c5e94477ba7521982c0375

                                                                                                                                          SHA1

                                                                                                                                          c7d31fd2ae975ae8f409f47dfb044e3972e548c0

                                                                                                                                          SHA256

                                                                                                                                          0c3419ff8ddebff25027285ff876f30569e7915b993930411b230cfbf3e52214

                                                                                                                                          SHA512

                                                                                                                                          168265315dfcfd666cb681da84d0616fb74f9e389073a5a377acbca45320206097f59cc629ea93b8618ec8a265ef6a0a0d5e4a45f26ef133f53ca40234eb314f

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000858001\alex12341.exe

                                                                                                                                          Filesize

                                                                                                                                          448KB

                                                                                                                                          MD5

                                                                                                                                          29bc9a61bf28db1c542ec72809af203a

                                                                                                                                          SHA1

                                                                                                                                          479e77270fef98ebd5f610ce6f552a28a4b1a50c

                                                                                                                                          SHA256

                                                                                                                                          24728075b153576aaedc56b4bac4227c4ebad5b22d295ef24a90cb8876818f2f

                                                                                                                                          SHA512

                                                                                                                                          71dd8669b44522a2e89898e76406a95b58fe33c5605b9618440949bc2249a93e97efe48a9ff66c38d1c7fd1f5669533ba717271ebf40a21458705e18be9f0849

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000865001\TeamFour.exe

                                                                                                                                          Filesize

                                                                                                                                          384KB

                                                                                                                                          MD5

                                                                                                                                          ff1f55e36cb57985bfb06485192c9a51

                                                                                                                                          SHA1

                                                                                                                                          4f967c330d214d8ba71db3202e98e14788ef9dc2

                                                                                                                                          SHA256

                                                                                                                                          10cf3110c39faca3ae53e0a7fee4c523bd6a0cb9501d7e79a43bee7a3c3c069a

                                                                                                                                          SHA512

                                                                                                                                          bb30c5668b60da62ae4bdeed9ad627510ccefe28ed3d08acaaeb3afb379d1746a040a290eac56446b53b84869c1c17e8462c7a514c20bf93080048702afe42e3

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe

                                                                                                                                          Filesize

                                                                                                                                          1.2MB

                                                                                                                                          MD5

                                                                                                                                          cfcf23a84dcbef24a4fb3e1942b3afb8

                                                                                                                                          SHA1

                                                                                                                                          0996772f7f964914854e0c51326b7cda2b0df5a6

                                                                                                                                          SHA256

                                                                                                                                          63e515b57c4babc200de2e6f21b76027639b1ef13fd83c988101fdfc88b98b4c

                                                                                                                                          SHA512

                                                                                                                                          3f10ec3c16da19f2e4621737b8cf11401f426683ffed6aea0b05d2b35b840a56a99373b6f112554c7cf19750fc37ee6ee6510cd84285612112f9cdf3e66cfbcc

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000874021\random.cmd

                                                                                                                                          Filesize

                                                                                                                                          104B

                                                                                                                                          MD5

                                                                                                                                          7ca00195b480ee284ddaebfea321f27e

                                                                                                                                          SHA1

                                                                                                                                          a9ef34c03c1285c450b0414a20fce7f9533f7fa6

                                                                                                                                          SHA256

                                                                                                                                          c133cb730f4483b60434981714e8544a30bdb422376495c74aabeb16b13fd5d6

                                                                                                                                          SHA512

                                                                                                                                          c78ba3153ac0999f71c1ab0e5c4738e2e46d03f6567045e8c5ec3bd7157adabe4ce61b56554c546ce6070f09c84f26a64354ffaef0bf32175a4b40c27d4a3035

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000875001\amadka.exe

                                                                                                                                          Filesize

                                                                                                                                          1.8MB

                                                                                                                                          MD5

                                                                                                                                          3bd163978ec480a0fba2ef140cfe5729

                                                                                                                                          SHA1

                                                                                                                                          e04757c4cbf74bb00f218f43cb2a72fbe041dbfd

                                                                                                                                          SHA256

                                                                                                                                          940f096bc2b614d61b01c951f45c23e786f9fc9337c6f6ccfde332dad221943e

                                                                                                                                          SHA512

                                                                                                                                          a4dd52b21895b1b988b3023ed253b47bfcefe68d693583f94290b8e52063258aa797f7237de35fe6eaf0dc8272304cc978cab9c34d2705490661e04cf2848f10

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000903001\lummahelp.exe

                                                                                                                                          Filesize

                                                                                                                                          468KB

                                                                                                                                          MD5

                                                                                                                                          40dd510795e82f9a51301896809c2d95

                                                                                                                                          SHA1

                                                                                                                                          5bc4f3a04dae16cd6c69dd442551a795c9caa9ef

                                                                                                                                          SHA256

                                                                                                                                          18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492

                                                                                                                                          SHA512

                                                                                                                                          c2fa10356790136e1bacbf0bc26eb015d6ceae49d2fb953fc80cb3085375d050000b2672cf15bc97fd633a31e6012e0fe47e282f31a614192840f85624b693c8

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000935001\InstallSetup3.exe

                                                                                                                                          Filesize

                                                                                                                                          1.9MB

                                                                                                                                          MD5

                                                                                                                                          5e899fcd52b9d9cc9df0b8ef66819d73

                                                                                                                                          SHA1

                                                                                                                                          9781f2740f504918d374787c02295b18a85f5522

                                                                                                                                          SHA256

                                                                                                                                          7247cadfb4181bc0541ffbc1a6a87e6328259df520246299056942dda5e4f34b

                                                                                                                                          SHA512

                                                                                                                                          09fba59611124f2d02357987b73ddfc7c4e1ed46b3d0b5bc591c626e9be0cd2eaa00d110891fcb35fa29d9f70954056cd9fded7b66c68db3f9a424b4c5619835

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd

                                                                                                                                          Filesize

                                                                                                                                          81KB

                                                                                                                                          MD5

                                                                                                                                          a4b636201605067b676cc43784ae5570

                                                                                                                                          SHA1

                                                                                                                                          e9f49d0fc75f25743d04ce23c496eb5f89e72a9a

                                                                                                                                          SHA256

                                                                                                                                          f178e29921c04fb68cc08b1e5d1181e5df8ce1de38a968778e27990f4a69973c

                                                                                                                                          SHA512

                                                                                                                                          02096bc36c7a9ecfa1712fe738b5ef8b78c6964e0e363136166657c153727b870a6a44c1e1ec9b81289d1aa0af9c85f1a37b95b667103edc2d3916280b6a9488

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_sqlite3.pyd

                                                                                                                                          Filesize

                                                                                                                                          95KB

                                                                                                                                          MD5

                                                                                                                                          7f61eacbbba2ecf6bf4acf498fa52ce1

                                                                                                                                          SHA1

                                                                                                                                          3174913f971d031929c310b5e51872597d613606

                                                                                                                                          SHA256

                                                                                                                                          85de6d0b08b5cc1f2c3225c07338c76e1cab43b4de66619824f7b06cb2284c9e

                                                                                                                                          SHA512

                                                                                                                                          a5f6f830c7a5fadc3349b42db0f3da1fddb160d7e488ea175bf9be4732a18e277d2978720c0e294107526561a7011fadab992c555d93e77d4411528e7c4e695a

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\cryptography\hazmat\bindings\_rust.pyd

                                                                                                                                          Filesize

                                                                                                                                          1.4MB

                                                                                                                                          MD5

                                                                                                                                          71a93b535f9b7d0bc771c9ec73111b49

                                                                                                                                          SHA1

                                                                                                                                          e83477b0f8a341c4826875c4f1a9f09ebf52c626

                                                                                                                                          SHA256

                                                                                                                                          7a309bc4bba63c4d1c7a52a21a3608b6e76e658fb83b6cd178d128a977b20419

                                                                                                                                          SHA512

                                                                                                                                          f5ba3b2f8102b4d35077ff171360069a196574184d9524d8a185d720a11940ac629b4d015345513a04ba40ee8452667ad65bddb75e6c493c40ddd207b3174230

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libssl-1_1.dll

                                                                                                                                          Filesize

                                                                                                                                          682KB

                                                                                                                                          MD5

                                                                                                                                          de72697933d7673279fb85fd48d1a4dd

                                                                                                                                          SHA1

                                                                                                                                          085fd4c6fb6d89ffcc9b2741947b74f0766fc383

                                                                                                                                          SHA256

                                                                                                                                          ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f

                                                                                                                                          SHA512

                                                                                                                                          0fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pyd

                                                                                                                                          Filesize

                                                                                                                                          28KB

                                                                                                                                          MD5

                                                                                                                                          adc412384b7e1254d11e62e451def8e9

                                                                                                                                          SHA1

                                                                                                                                          04e6dff4a65234406b9bc9d9f2dcfe8e30481829

                                                                                                                                          SHA256

                                                                                                                                          68b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1

                                                                                                                                          SHA512

                                                                                                                                          f250f1236882668b2686bd42e1c334c60da7abec3a208ebebdee84a74d7c4c6b1bc79eed7241bc7012e4ef70a6651a32aa00e32a83f402475b479633581e0b07

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\sqlite3.dll

                                                                                                                                          Filesize

                                                                                                                                          1.4MB

                                                                                                                                          MD5

                                                                                                                                          926dc90bd9faf4efe1700564aa2a1700

                                                                                                                                          SHA1

                                                                                                                                          763e5af4be07444395c2ab11550c70ee59284e6d

                                                                                                                                          SHA256

                                                                                                                                          50825ea8b431d86ec228d9fa6b643e2c70044c709f5d9471d779be63ff18bcd0

                                                                                                                                          SHA512

                                                                                                                                          a8703ff97243aa3bc877f71c0514b47677b48834a0f2fee54e203c0889a79ce37c648243dbfe2ee9e1573b3ca4d49c334e9bfe62541653125861a5398e2fe556

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\yarl\_quoting_c.pyd

                                                                                                                                          Filesize

                                                                                                                                          93KB

                                                                                                                                          MD5

                                                                                                                                          8b4cd87707f15f838b5db8ed5b5021d2

                                                                                                                                          SHA1

                                                                                                                                          bbc05580a181e1c03e0a53760c1559dc99b746fe

                                                                                                                                          SHA256

                                                                                                                                          eefb46501ef97baf29a93304f58674e70f5ccecafb183f230e5ce7872a852f56

                                                                                                                                          SHA512

                                                                                                                                          6768cff12fa22fe8540a3f6bdb350a5fcec0b2a0f01531458eb23f77b24460620cd400078fd1ec63738884c2b78920e428126833953c26b8dc8ad8b7c069415d

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u41u1oz4.o5y.ps1

                                                                                                                                          Filesize

                                                                                                                                          60B

                                                                                                                                          MD5

                                                                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                          SHA1

                                                                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                          SHA256

                                                                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                          SHA512

                                                                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\nst6649.tmp\INetC.dll

                                                                                                                                          Filesize

                                                                                                                                          21KB

                                                                                                                                          MD5

                                                                                                                                          2b342079303895c50af8040a91f30f71

                                                                                                                                          SHA1

                                                                                                                                          b11335e1cb8356d9c337cb89fe81d669a69de17e

                                                                                                                                          SHA256

                                                                                                                                          2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

                                                                                                                                          SHA512

                                                                                                                                          550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\onefile_3884_133549495347338545\_asyncio.pyd

                                                                                                                                          Filesize

                                                                                                                                          62KB

                                                                                                                                          MD5

                                                                                                                                          6eb3c9fc8c216cea8981b12fd41fbdcd

                                                                                                                                          SHA1

                                                                                                                                          5f3787051f20514bb9e34f9d537d78c06e7a43e6

                                                                                                                                          SHA256

                                                                                                                                          3b0661ef2264d6566368b677c732ba062ac4688ef40c22476992a0f9536b0010

                                                                                                                                          SHA512

                                                                                                                                          2027707824d0948673443dd54b4f45bc44680c05c3c4a193c7c1803a1030124ad6c8fbe685cc7aaf15668d90c4cd9bfb93de51ea8db4af5abe742c1ef2dcd08b

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\onefile_3884_133549495347338545\_cffi_backend.pyd

                                                                                                                                          Filesize

                                                                                                                                          177KB

                                                                                                                                          MD5

                                                                                                                                          ebb660902937073ec9695ce08900b13d

                                                                                                                                          SHA1

                                                                                                                                          881537acead160e63fe6ba8f2316a2fbbb5cb311

                                                                                                                                          SHA256

                                                                                                                                          52e5a0c3ca9b0d4fc67243bd8492f5c305ff1653e8d956a2a3d9d36af0a3e4fd

                                                                                                                                          SHA512

                                                                                                                                          19d5000ef6e473d2f533603afe8d50891f81422c59ae03bead580412ec756723dc3379310e20cd0c39e9683ce7c5204791012e1b6b73996ea5cb59e8d371de24

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\onefile_3884_133549495347338545\_ctypes.pyd

                                                                                                                                          Filesize

                                                                                                                                          119KB

                                                                                                                                          MD5

                                                                                                                                          87596db63925dbfe4d5f0f36394d7ab0

                                                                                                                                          SHA1

                                                                                                                                          ad1dd48bbc078fe0a2354c28cb33f92a7e64907e

                                                                                                                                          SHA256

                                                                                                                                          92d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4

                                                                                                                                          SHA512

                                                                                                                                          e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\onefile_3884_133549495347338545\_hashlib.pyd

                                                                                                                                          Filesize

                                                                                                                                          60KB

                                                                                                                                          MD5

                                                                                                                                          49ce7a28e1c0eb65a9a583a6ba44fa3b

                                                                                                                                          SHA1

                                                                                                                                          dcfbee380e7d6c88128a807f381a831b6a752f10

                                                                                                                                          SHA256

                                                                                                                                          1be5cfd06a782b2ae8e4629d9d035cbc487074e8f63b9773c85e317be29c0430

                                                                                                                                          SHA512

                                                                                                                                          cf1f96d6d61ecb2997bb541e9eda7082ef4a445d3dd411ce6fd71b0dfe672f4dfaddf36ae0fb7d5f6d1345fbd90c19961a8f35328332cdaa232f322c0bf9a1f9

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\onefile_3884_133549495347338545\_lzma.pyd

                                                                                                                                          Filesize

                                                                                                                                          154KB

                                                                                                                                          MD5

                                                                                                                                          b5fbc034ad7c70a2ad1eb34d08b36cf8

                                                                                                                                          SHA1

                                                                                                                                          4efe3f21be36095673d949cceac928e11522b29c

                                                                                                                                          SHA256

                                                                                                                                          80a6ebe46f43ffa93bbdbfc83e67d6f44a44055de1439b06e4dd2983cb243df6

                                                                                                                                          SHA512

                                                                                                                                          e7185da748502b645030c96d3345d75814ba5fd95a997c2d1c923d981c44d5b90db64faf77ddbbdc805769af1bec37daf0ecee0930a248b67a1c2d92b59c250c

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\onefile_3884_133549495347338545\_overlapped.pyd

                                                                                                                                          Filesize

                                                                                                                                          47KB

                                                                                                                                          MD5

                                                                                                                                          7e6bd435c918e7c34336c7434404eedf

                                                                                                                                          SHA1

                                                                                                                                          f3a749ad1d7513ec41066ab143f97fa4d07559e1

                                                                                                                                          SHA256

                                                                                                                                          0606a0c5c4ab46c4a25ded5a2772e672016cac574503681841800f9059af21c4

                                                                                                                                          SHA512

                                                                                                                                          c8bf4b1ec6c8fa09c299a8418ee38cdccb04afa3a3c2e6d92625dbc2de41f81dd0df200fd37fcc41909c2851ac5ca936af632307115b9ac31ec020d9ed63f157

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\onefile_3884_133549495347338545\_socket.pyd

                                                                                                                                          Filesize

                                                                                                                                          75KB

                                                                                                                                          MD5

                                                                                                                                          e137df498c120d6ac64ea1281bcab600

                                                                                                                                          SHA1

                                                                                                                                          b515e09868e9023d43991a05c113b2b662183cfe

                                                                                                                                          SHA256

                                                                                                                                          8046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a

                                                                                                                                          SHA512

                                                                                                                                          cc2772d282b81873aa7c5cba5939d232cceb6be0908b211edb18c25a17cbdb5072f102c0d6b7bc9b6b2f1f787b56ab1bc9be731bb9e98885c17e26a09c2beb90

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\onefile_3884_133549495347338545\_ssl.pyd

                                                                                                                                          Filesize

                                                                                                                                          155KB

                                                                                                                                          MD5

                                                                                                                                          35f66ad429cd636bcad858238c596828

                                                                                                                                          SHA1

                                                                                                                                          ad4534a266f77a9cdce7b97818531ce20364cb65

                                                                                                                                          SHA256

                                                                                                                                          58b772b53bfe898513c0eb264ae4fa47ed3d8f256bc8f70202356d20f9ecb6dc

                                                                                                                                          SHA512

                                                                                                                                          1cca8e6c3a21a8b05cc7518bd62c4e3f57937910f2a310e00f13f60f6a94728ef2004a2f4a3d133755139c3a45b252e6db76987b6b78bc8269a21ad5890356ad

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\onefile_3884_133549495347338545\aiohttp\_helpers.pyd

                                                                                                                                          Filesize

                                                                                                                                          38KB

                                                                                                                                          MD5

                                                                                                                                          d2bf6ca0df56379f1401efe347229dd2

                                                                                                                                          SHA1

                                                                                                                                          95c6a524a9b64ec112c32475f06a0821ff7e79c9

                                                                                                                                          SHA256

                                                                                                                                          04d56d6aa727665802283b8adf9b873c1dd76dfc7265a12c0f627528ba706040

                                                                                                                                          SHA512

                                                                                                                                          b4a2b9f71b156731aa071d13bf8dcffec4091d8d2fab47aea1ff47cd7abff13e28acf1d9456a97eb7a5723dbfa166fc63de11c63dc5cb63b13b4df9930390377

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\onefile_3884_133549495347338545\aiohttp\_http_writer.pyd

                                                                                                                                          Filesize

                                                                                                                                          34KB

                                                                                                                                          MD5

                                                                                                                                          e16a71fc322a3a718aeaeaef0eeeab76

                                                                                                                                          SHA1

                                                                                                                                          78872d54d016590df87208518e3e6515afce5f41

                                                                                                                                          SHA256

                                                                                                                                          51490359d8079232565187223517eca99e1ce55bc97b93cf966d2a5c1f2e5435

                                                                                                                                          SHA512

                                                                                                                                          a9a7877aa77d000ba2dd7d96cf88a0e9afb6f6decb9530c1d4e840c270dd1805e73401266b1c8e17c1418effb823c1bd91b13f82dbfc6dba455940e3e644de54

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\onefile_3884_133549495347338545\cryptography\hazmat\bindings\_rust.pyd

                                                                                                                                          Filesize

                                                                                                                                          4.6MB

                                                                                                                                          MD5

                                                                                                                                          9b0f0f6529c37c68d917fd53cf3e3e63

                                                                                                                                          SHA1

                                                                                                                                          49783ec7d49cbbaf296e910ae97b974e1f957d65

                                                                                                                                          SHA256

                                                                                                                                          e5c6ad597af159593952ff38ab1821e5e6da1575f1c4e575ba87985d831f4c84

                                                                                                                                          SHA512

                                                                                                                                          dc43c6242d2c485e0951a1e539192c7598930ac408d436d25aaa963e97d6100e2d8877278e2b817252b5d73d0a1b92ea468667a9e3cbffbfa6b92951ab54cc8e

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\onefile_3884_133549495347338545\libcrypto-1_1.dll

                                                                                                                                          Filesize

                                                                                                                                          3.3MB

                                                                                                                                          MD5

                                                                                                                                          ab01c808bed8164133e5279595437d3d

                                                                                                                                          SHA1

                                                                                                                                          0f512756a8db22576ec2e20cf0cafec7786fb12b

                                                                                                                                          SHA256

                                                                                                                                          9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55

                                                                                                                                          SHA512

                                                                                                                                          4043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\onefile_3884_133549495347338545\libffi-7.dll

                                                                                                                                          Filesize

                                                                                                                                          32KB

                                                                                                                                          MD5

                                                                                                                                          eef7981412be8ea459064d3090f4b3aa

                                                                                                                                          SHA1

                                                                                                                                          c60da4830ce27afc234b3c3014c583f7f0a5a925

                                                                                                                                          SHA256

                                                                                                                                          f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

                                                                                                                                          SHA512

                                                                                                                                          dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\onefile_3884_133549495347338545\multidict\_multidict.pyd

                                                                                                                                          Filesize

                                                                                                                                          45KB

                                                                                                                                          MD5

                                                                                                                                          ddd4c0ae1e0d166c22449e9dcdca20d7

                                                                                                                                          SHA1

                                                                                                                                          ff0e3d889b4e8bc43b0f13aa1154776b0df95700

                                                                                                                                          SHA256

                                                                                                                                          74ec52418c5d38a63add94228c6f68cf49519666ae8bcb7ac199f7d539d8612c

                                                                                                                                          SHA512

                                                                                                                                          c8464a77ba8b504ba9c7873f76499174095393c42dc85a9c1be2875c3661cda928851e37013e4ac95ba539eed984bf71c0fcc2cb599f3f0c4c1588d4a692bdfd

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\onefile_3884_133549495347338545\python3.dll

                                                                                                                                          Filesize

                                                                                                                                          63KB

                                                                                                                                          MD5

                                                                                                                                          07bd9f1e651ad2409fd0b7d706be6071

                                                                                                                                          SHA1

                                                                                                                                          dfeb2221527474a681d6d8b16a5c378847c59d33

                                                                                                                                          SHA256

                                                                                                                                          5d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5

                                                                                                                                          SHA512

                                                                                                                                          def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\onefile_3884_133549495347338545\python310.dll

                                                                                                                                          Filesize

                                                                                                                                          4.3MB

                                                                                                                                          MD5

                                                                                                                                          c80b5cb43e5fe7948c3562c1fff1254e

                                                                                                                                          SHA1

                                                                                                                                          f73cb1fb9445c96ecd56b984a1822e502e71ab9d

                                                                                                                                          SHA256

                                                                                                                                          058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

                                                                                                                                          SHA512

                                                                                                                                          faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\onefile_3884_133549495347338545\sqlite3.dll

                                                                                                                                          Filesize

                                                                                                                                          1.2MB

                                                                                                                                          MD5

                                                                                                                                          194868123112ea432ac0132663b8f234

                                                                                                                                          SHA1

                                                                                                                                          89cce5e288b0395f724db9c1f31c94f313af3606

                                                                                                                                          SHA256

                                                                                                                                          be99aa38d534354da71e1faeb97f0e1f950e91399ce880ea1791c802f1ab9159

                                                                                                                                          SHA512

                                                                                                                                          7e24041138956a84bad1378151788db36e6ed3ae3402c9882905010d99f76f016371c9b2ed0259d7163672b2e61dac9c358e1aae021523349c352dd9b2898ffc

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\onefile_3884_133549495347338545\stub.exe

                                                                                                                                          Filesize

                                                                                                                                          5.1MB

                                                                                                                                          MD5

                                                                                                                                          b369ac83def696d0611f36dea3b2d91a

                                                                                                                                          SHA1

                                                                                                                                          345c8166f8e263aeff6682785046f35204ad4377

                                                                                                                                          SHA256

                                                                                                                                          9e96c07c8367dba85020966a4c7b61deef00b5bceb94e131b68d429be97940d1

                                                                                                                                          SHA512

                                                                                                                                          a21a538c7979f1d933bb3d87d02d9784124be8e0b6eb9257f2d8a927fad54f74a22cde1828367ce434a2b4d62e8764c81e0fc82c677095617efc5108b3bc3c12

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\onefile_3884_133549495347338545\stub.exe

                                                                                                                                          Filesize

                                                                                                                                          5.5MB

                                                                                                                                          MD5

                                                                                                                                          1a36107ab499f47e33026d13348b27e3

                                                                                                                                          SHA1

                                                                                                                                          6cdc766ff3cea7f7013219e24dc8ba00106fbc49

                                                                                                                                          SHA256

                                                                                                                                          cf05c5e561e190fd32936add593d63a1ab6e182ee8dee86c1f94c4e6596d4f9d

                                                                                                                                          SHA512

                                                                                                                                          72cc1b1becb673daece48bce894ee282139dbff961d49402a9bc008bdaa921f537c58d2a87e90aea87d546bc07f970ba7b3cc173fd0434c1cbe478ddcf910767

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\onefile_3884_133549495347338545\unicodedata.pyd

                                                                                                                                          Filesize

                                                                                                                                          1.1MB

                                                                                                                                          MD5

                                                                                                                                          102bbbb1f33ce7c007aac08fe0a1a97e

                                                                                                                                          SHA1

                                                                                                                                          9a8601bea3e7d4c2fa6394611611cda4fc76e219

                                                                                                                                          SHA256

                                                                                                                                          2cf6c5dea30bb0584991b2065c052c22d258b6e15384447dcea193fdcac5f758

                                                                                                                                          SHA512

                                                                                                                                          a07731f314e73f7a9ea73576a89ccb8a0e55e53f9b5b82f53121b97b1814d905b17a2da9bd2eda9f9354fc3f15e3dea7a613d7c9bc98c36bba653743b24dfc32

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\onefile_3884_133549495347338545\vcruntime140.dll

                                                                                                                                          Filesize

                                                                                                                                          96KB

                                                                                                                                          MD5

                                                                                                                                          f12681a472b9dd04a812e16096514974

                                                                                                                                          SHA1

                                                                                                                                          6fd102eb3e0b0e6eef08118d71f28702d1a9067c

                                                                                                                                          SHA256

                                                                                                                                          d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

                                                                                                                                          SHA512

                                                                                                                                          7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmp64D2.tmp

                                                                                                                                          Filesize

                                                                                                                                          20KB

                                                                                                                                          MD5

                                                                                                                                          49693267e0adbcd119f9f5e02adf3a80

                                                                                                                                          SHA1

                                                                                                                                          3ba3d7f89b8ad195ca82c92737e960e1f2b349df

                                                                                                                                          SHA256

                                                                                                                                          d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

                                                                                                                                          SHA512

                                                                                                                                          b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmp6523.tmp

                                                                                                                                          Filesize

                                                                                                                                          48KB

                                                                                                                                          MD5

                                                                                                                                          349e6eb110e34a08924d92f6b334801d

                                                                                                                                          SHA1

                                                                                                                                          bdfb289daff51890cc71697b6322aa4b35ec9169

                                                                                                                                          SHA256

                                                                                                                                          c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

                                                                                                                                          SHA512

                                                                                                                                          2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmp6555.tmp

                                                                                                                                          Filesize

                                                                                                                                          116KB

                                                                                                                                          MD5

                                                                                                                                          f70aa3fa04f0536280f872ad17973c3d

                                                                                                                                          SHA1

                                                                                                                                          50a7b889329a92de1b272d0ecf5fce87395d3123

                                                                                                                                          SHA256

                                                                                                                                          8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                                                                                                          SHA512

                                                                                                                                          30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                                                                                                        • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                                                                                                                                          Filesize

                                                                                                                                          109KB

                                                                                                                                          MD5

                                                                                                                                          2afdbe3b99a4736083066a13e4b5d11a

                                                                                                                                          SHA1

                                                                                                                                          4d4856cf02b3123ac16e63d4a448cdbcb1633546

                                                                                                                                          SHA256

                                                                                                                                          8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee

                                                                                                                                          SHA512

                                                                                                                                          d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f

                                                                                                                                        • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                                                                                                                                          Filesize

                                                                                                                                          1.2MB

                                                                                                                                          MD5

                                                                                                                                          92fbdfccf6a63acef2743631d16652a7

                                                                                                                                          SHA1

                                                                                                                                          971968b1378dd89d59d7f84bf92f16fc68664506

                                                                                                                                          SHA256

                                                                                                                                          b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72

                                                                                                                                          SHA512

                                                                                                                                          b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117

                                                                                                                                        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                                                                                                                                          Filesize

                                                                                                                                          109KB

                                                                                                                                          MD5

                                                                                                                                          726cd06231883a159ec1ce28dd538699

                                                                                                                                          SHA1

                                                                                                                                          404897e6a133d255ad5a9c26ac6414d7134285a2

                                                                                                                                          SHA256

                                                                                                                                          12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

                                                                                                                                          SHA512

                                                                                                                                          9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

                                                                                                                                        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

                                                                                                                                          Filesize

                                                                                                                                          1.2MB

                                                                                                                                          MD5

                                                                                                                                          15a42d3e4579da615a384c717ab2109b

                                                                                                                                          SHA1

                                                                                                                                          22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

                                                                                                                                          SHA256

                                                                                                                                          3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

                                                                                                                                          SHA512

                                                                                                                                          1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

                                                                                                                                        • C:\Users\Admin\AppData\Roaming\configurationValue\TWO.exe

                                                                                                                                          Filesize

                                                                                                                                          296KB

                                                                                                                                          MD5

                                                                                                                                          28f30e43da4c45f023b546fc871a12ea

                                                                                                                                          SHA1

                                                                                                                                          ab063bbb313b75320f4335a8cd878f7a02e5f91c

                                                                                                                                          SHA256

                                                                                                                                          1e246855bc5d7648a3425771faa304d08ce84496a3afa7a023937ac41d381c6b

                                                                                                                                          SHA512

                                                                                                                                          559099480bc8518f740249b096c123bc5dfb9dc0126d1c681f4e650329cfb4383754ec8a307057f24b2692c36f4fa8e90b5b5d2debe1061e1ece27a7b26335b4

                                                                                                                                        • C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe

                                                                                                                                          Filesize

                                                                                                                                          278KB

                                                                                                                                          MD5

                                                                                                                                          ea1279a3e9e0c0d6ef4fb266f153e734

                                                                                                                                          SHA1

                                                                                                                                          5aeef1a7233ff1dccfbdf6d24bccdd29eb4fa96c

                                                                                                                                          SHA256

                                                                                                                                          9c38ecba653de6a28945eefb0d85def795dd25678d81c717b79fb00a07b70ad8

                                                                                                                                          SHA512

                                                                                                                                          e52e2233c285d918774fb9b3f01258ab070da9500e7568458c7362adcb0755b9a2b0a3df073d6c6a864df962c7556bb07c85d323dab951b8279f9c3fbf7aea29

                                                                                                                                        • memory/116-834-0x0000000000400000-0x000000000043D000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          244KB

                                                                                                                                        • memory/1544-196-0x0000000000C80000-0x0000000000E3A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          1.7MB

                                                                                                                                        • memory/1544-209-0x0000000072BD0000-0x0000000073380000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          7.7MB

                                                                                                                                        • memory/1544-296-0x0000000002FC0000-0x0000000004FC0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          32.0MB

                                                                                                                                        • memory/1544-301-0x0000000072BD0000-0x0000000073380000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          7.7MB

                                                                                                                                        • memory/1544-212-0x00000000057C0000-0x00000000057D0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/1876-833-0x0000000000400000-0x000000000063B000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.2MB

                                                                                                                                        • memory/1876-699-0x0000000000400000-0x000000000063B000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.2MB

                                                                                                                                        • memory/1876-615-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          972KB

                                                                                                                                        • memory/1876-839-0x0000000000400000-0x000000000063B000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.2MB

                                                                                                                                        • memory/1888-586-0x0000000000400000-0x000000000043D000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          244KB

                                                                                                                                        • memory/1904-5-0x00000000054B0000-0x00000000054B1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1904-0-0x0000000000AF0000-0x0000000000F93000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4.6MB

                                                                                                                                        • memory/1904-4-0x0000000005480000-0x0000000005481000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1904-16-0x0000000000AF0000-0x0000000000F93000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4.6MB

                                                                                                                                        • memory/1904-7-0x0000000005460000-0x0000000005461000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1904-2-0x0000000000AF0000-0x0000000000F93000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4.6MB

                                                                                                                                        • memory/1904-10-0x00000000054D0000-0x00000000054D1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1904-6-0x0000000005440000-0x0000000005441000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1904-11-0x00000000054C0000-0x00000000054C1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1904-9-0x00000000054A0000-0x00000000054A1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1904-1-0x0000000076FC4000-0x0000000076FC6000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          8KB

                                                                                                                                        • memory/1904-3-0x0000000005470000-0x0000000005471000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1904-8-0x0000000005450000-0x0000000005451000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/2052-102-0x0000000005500000-0x0000000005510000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/2052-93-0x0000000008470000-0x000000000857A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          1.0MB

                                                                                                                                        • memory/2052-104-0x0000000072BD0000-0x0000000073380000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          7.7MB

                                                                                                                                        • memory/2052-91-0x0000000006AE0000-0x00000000070F8000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          6.1MB

                                                                                                                                        • memory/2052-89-0x0000000005520000-0x000000000552A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          40KB

                                                                                                                                        • memory/2052-87-0x0000000005C00000-0x00000000061A4000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          5.6MB

                                                                                                                                        • memory/2052-98-0x00000000083E0000-0x000000000841C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          240KB

                                                                                                                                        • memory/2052-79-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          320KB

                                                                                                                                        • memory/2052-99-0x0000000008420000-0x000000000846C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          304KB

                                                                                                                                        • memory/2052-97-0x0000000008380000-0x0000000008392000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          72KB

                                                                                                                                        • memory/2052-88-0x0000000005650000-0x00000000056E2000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          584KB

                                                                                                                                        • memory/2140-270-0x00000000002E0000-0x0000000000783000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4.6MB

                                                                                                                                        • memory/2140-940-0x00000000002E0000-0x0000000000783000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4.6MB

                                                                                                                                        • memory/2140-276-0x00000000002E0000-0x0000000000783000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4.6MB

                                                                                                                                        • memory/2140-19-0x00000000002E0000-0x0000000000783000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4.6MB

                                                                                                                                        • memory/2140-20-0x00000000002E0000-0x0000000000783000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4.6MB

                                                                                                                                        • memory/2140-26-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/2140-25-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/2140-24-0x0000000005040000-0x0000000005041000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/2140-22-0x0000000005020000-0x0000000005021000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/2140-403-0x00000000002E0000-0x0000000000783000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4.6MB

                                                                                                                                        • memory/2140-870-0x00000000002E0000-0x0000000000783000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4.6MB

                                                                                                                                        • memory/2140-23-0x0000000005000000-0x0000000005001000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/2140-103-0x00000000002E0000-0x0000000000783000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4.6MB

                                                                                                                                        • memory/2140-201-0x00000000002E0000-0x0000000000783000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4.6MB

                                                                                                                                        • memory/2140-21-0x0000000005010000-0x0000000005011000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/2140-27-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/2140-28-0x0000000005050000-0x0000000005051000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/2140-755-0x00000000002E0000-0x0000000000783000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4.6MB

                                                                                                                                        • memory/2140-590-0x00000000002E0000-0x0000000000783000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4.6MB

                                                                                                                                        • memory/2228-302-0x0000000072BD0000-0x0000000073380000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          7.7MB

                                                                                                                                        • memory/2228-294-0x0000000000400000-0x0000000000592000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          1.6MB

                                                                                                                                        • memory/2396-935-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          9.1MB

                                                                                                                                        • memory/2396-840-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          9.1MB

                                                                                                                                        • memory/2760-945-0x0000000000880000-0x0000000000C36000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          3.7MB

                                                                                                                                        • memory/2760-897-0x0000000000880000-0x0000000000C36000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          3.7MB

                                                                                                                                        • memory/2760-777-0x0000000000880000-0x0000000000C36000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          3.7MB

                                                                                                                                        • memory/2980-90-0x0000000003200000-0x0000000005200000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          32.0MB

                                                                                                                                        • memory/2980-65-0x0000000072BD0000-0x0000000073380000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          7.7MB

                                                                                                                                        • memory/2980-85-0x0000000072BD0000-0x0000000073380000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          7.7MB

                                                                                                                                        • memory/2980-57-0x0000000000DC0000-0x0000000000E4C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          560KB

                                                                                                                                        • memory/2980-71-0x0000000005810000-0x0000000005820000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/3184-70-0x0000000072BD0000-0x0000000073380000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          7.7MB

                                                                                                                                        • memory/3184-69-0x0000000000D80000-0x0000000000E12000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          584KB

                                                                                                                                        • memory/3184-86-0x0000000072BD0000-0x0000000073380000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          7.7MB

                                                                                                                                        • memory/3184-84-0x0000000003290000-0x0000000005290000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          32.0MB

                                                                                                                                        • memory/3344-551-0x0000000000400000-0x0000000000448000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          288KB

                                                                                                                                        • memory/3344-554-0x0000000000400000-0x0000000000448000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          288KB

                                                                                                                                        • memory/3656-298-0x0000000000840000-0x00000000008CC000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          560KB

                                                                                                                                        • memory/3884-354-0x00007FF712340000-0x00007FF712E17000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.8MB

                                                                                                                                        • memory/3884-379-0x00007FF712340000-0x00007FF712E17000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.8MB

                                                                                                                                        • memory/3896-80-0x0000000000400000-0x0000000000448000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          288KB

                                                                                                                                        • memory/3896-96-0x00000000010E0000-0x0000000001112000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          200KB

                                                                                                                                        • memory/3896-92-0x0000000000400000-0x0000000000448000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          288KB

                                                                                                                                        • memory/3896-95-0x00000000010E0000-0x0000000001112000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          200KB

                                                                                                                                        • memory/3896-152-0x0000000000400000-0x0000000000448000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          288KB

                                                                                                                                        • memory/3896-101-0x00000000010E0000-0x0000000001112000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          200KB

                                                                                                                                        • memory/3896-100-0x00000000010E0000-0x0000000001112000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          200KB

                                                                                                                                        • memory/3896-94-0x00000000010E0000-0x0000000001112000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          200KB

                                                                                                                                        • memory/3896-76-0x0000000000400000-0x0000000000448000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          288KB

                                                                                                                                        • memory/4184-374-0x00007FF624BE0000-0x00007FF625E19000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          18.2MB

                                                                                                                                        • memory/4352-291-0x00007FFE64AF0000-0x00007FFE655B1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.8MB

                                                                                                                                        • memory/4352-257-0x00000135EA620000-0x00000135EA642000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          136KB

                                                                                                                                        • memory/4352-287-0x00000135EA6B0000-0x00000135EA6C0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/4352-272-0x00000135EA690000-0x00000135EA69A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          40KB

                                                                                                                                        • memory/4352-290-0x00000135EA6B0000-0x00000135EA6C0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/4352-271-0x00000135EAC00000-0x00000135EAC12000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          72KB

                                                                                                                                        • memory/4352-288-0x00000135EA6B0000-0x00000135EA6C0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/4492-900-0x0000000000EE0000-0x0000000001296000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          3.7MB

                                                                                                                                        • memory/4492-462-0x0000000000EE0000-0x0000000001296000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          3.7MB

                                                                                                                                        • memory/4492-801-0x0000000000EE0000-0x0000000001296000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          3.7MB

                                                                                                                                        • memory/4492-697-0x0000000000EE0000-0x0000000001296000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          3.7MB

                                                                                                                                        • memory/4492-957-0x0000000000EE0000-0x0000000001296000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          3.7MB

                                                                                                                                        • memory/5040-545-0x0000000000C70000-0x0000000001127000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4.7MB

                                                                                                                                        • memory/5352-941-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          9.1MB

                                                                                                                                        • memory/5428-756-0x0000000000400000-0x0000000000930000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          5.2MB

                                                                                                                                        • memory/5800-895-0x0000000000E70000-0x0000000001327000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4.7MB

                                                                                                                                        • memory/5980-832-0x0000000000E70000-0x0000000001327000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4.7MB

                                                                                                                                        • memory/5980-914-0x0000000000E70000-0x0000000001327000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4.7MB

                                                                                                                                        • memory/5980-698-0x0000000000E70000-0x0000000001327000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4.7MB

                                                                                                                                        • memory/5980-972-0x0000000000E70000-0x0000000001327000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4.7MB